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© Electronic monetary system. 

© An improved monetary system using electronic media to exchange economic value securely and reliably. 
The invention provides a complete monetary system having electronic money that is interchangeable with 
conventional paper money comprising (1) issuing banks or financial institutions that are coupled to a money 
generator device for generating and issuing to subscribing customers electronic currency backed by demand 
deposits electronic credit authorizations; (2) correspondent banks that accept and distribute the electronic 
money (3) a plurality of transaction devices that are used by subscribers for storing electronic money, for 
performing money transactions with the on-line systems of the participating banks or for exchanging electronic 
money with other like transaction devices; (4) automated teller devices, associated with the issuing and 
correspondent banks, for process handling and interfacing the transaction devices to the issuing and cor- 
respondent banks, and for interfacing between the issuing and correspondent banks themselves; and (5) a 
clearing bank for balancing the electronic money accounts of the different issuing banks (6). 



CM 
< 

00 

o> 

CM 
CM 



Q. 
LU 



BNSDOCID: <EP 0542298A2J_> 



Rank Xerox (UK) Business Services 

(3. 10/3.6/3.3. 1> 



EP 0 542 298 A2 



Backgroun d of the Invention 

The present invention relates to an electronic monetary system for implementing electronic money 
payments as an alternative medium of economic exchange to cash, checks, credit and debit cards, and 

5 electronics fund transfer. The Electronic - Monetary System is a hybrid of currency, check, card payment 
systems and electronic funds transfer systems, possessing many of the benefits of these systems with few 
of their limitations. The system utilizes electronic representations of money which are designed to be 
universally accepted and exchanged as economic value by subscribers of the monetary system. 

Today, approximately 350 billion coin and currency transactions occur between individuals and 

w institutions every year. The extensive use of coin and currency transactions has limited the automation of 
individual transactions such as purchases, fares, and bank account deposits and withdrawals. Individual 
cash transactions are burdened by the need of having the correct amount or providing change therefor. 
Furthermore, the handling and managing of paper cash and coins is inconvenient, costly and time 
consuming for both individuals and financial institutions alike. 

75 Although checks may be written for any specific amount up to the amount available in the account, 

checks have very limited transferability and must be supplied from a physical inventory. Paper -based 
checking systems do not offer sufficient relief from the limitations of cash transactions, sharing many of the 
inconveniences of handling currency while adding the inherent delays associated with processing checks. 
To this end, economic exchange has striven for greater convenience at a lower cost, while also seeking 

20 improved security. 

Automation has achieved some of these qualities for large transactions through computerized electronic 
funds transfer ("EFT") systems. Electronic funds transfer is essentially a process of value exchange 
achieved through the banking system's centralized computer transactions. EFT services are a transfer of 
payments utilizing electronic "checks," which are used primarily by large commercial organizations. 

25 The Automated Clearing House (ACH) and point of sale (POS) systems are examples of electronic 
funds transfer systems that have become used by retail and commercial organizations on a substantial 
basis in recent years. However, the payments made through these types of EFT systems are limited in that 
they cannot be performed outside of the banking system. Moreover, ACH transactions usually cannot be 
performed during off business hours. 

30 Home banking bill payment services are examples of an electronic funds transfer system used by 
individuals to make payments. Currently, home banking initiatives have found few customers. Of the banks 
that have offered services for payments, account transfers and information over the telephone lines using 
personal computers, less than one percent of the bank's customers are using the service. One reason that 
home banking has not been a successful product because the customer cannot deposit and withdraw 

35 money as needed in this type of system. 

Current EFT systems, credit cards, or debit cards, which are used with an on-line system to transfer 
money between accounts, such as between the account of a merchant and that of a customer, cannot 
satisfy the need for an automated transaction system that provides for the transfer of universally accepted 
economic value outside of the banking system. 

40 To implement an automated, yet more convenient transaction system that does not require the banking 
system to intermediate the transfer, and that can dispense some form of economic value, there has been a 
trend towards off-line electronic funds transfer. For example, numerous ideas have been proposed for 
some form of "electronic money" that can be used in cashless payment transactions as alternatives to the 
traditional currency and check types of payment systems. See U.S. Patent No. 4,977,595, entitled 

45 "METHOD AND APPARATUS FOR IMPLEMENTING ELECTRONIC CASH, and U.S. Patent No. 4,305,059, 
entitled "MODULAR FUNDS TRANSFER SYSTEM." 

The more well known techniques include magnetic stripe cards purchased for a given amount and from 
which a prepaid valve can be deducted for specific purposes. Upon exhaustion of the economic valve, the 
cards are thrown away. Other examples include memory cards or so called smart cards which are capable 

so of repetitively storing information representing value that is likewise deducted for specific purposes. 

However, these proposed systems suffer from a failure to recognize fully the significance of bank 
deposits as money, and their necessity to back any form of universally accepted monetary representations 
that may be issued. In the systems disclosed thus far, representations of economic value, whether 
electronic or paper, are issued without the backing of equal valued liabilities as the counterpart to their 

55 assets. 

None of the paperless payment systems that have been proposed so far are comprehensive enough so 
as to implement a multipurpose electronic monetary system that includes not only the automated devices 
that allow subscribers to transfer electronic funds or money between them without any intermediating 
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system, but that also encompasses and includes an entire banking system for generating the value 
Represented by the electronic money and for clearing and settling the electronic money accounts of the 
banks and financial institutions involved to maintain a monetary balance within the system. 

Thus specifically, there is a need for a system that allows common payor to payee transactions ; without 
5 the intermediation of the banking system, and that gives control of the payment process to *e .rjd.v.duaL 
Furthermore, a need exists for providing a system of economic exchange that can be used by large 
organizations for commercial payments of any size, that does not have the limitations of the current EFT 

^Accordingly it is an object of the present invention to overcome the aforesaid shortfalls by providing a 
w complete electronic monetary system which utilizes electronic money that is interchangeable with traditional 

cash and is universally accepted. t ;-„: n „ 
The present invention provides an electronic monetary system for provid.ng transactions utilizing 
electronic representations of currency backed by demand deposits in a bank comprising: 
means for generating said electronic representations of currency; teller means for issuing and d.stribut.ng 
,s sad electronic representations of currency; transacting means for storing, and for transferring said 
electronic representations of currency between other transacting means and between said transacting 

means and said teller means. .... 

The present invention also provides an electronic monetary system for prov.d.ng transact.ons utilizing 
electronic representations of credit authorizations comprising: x ^ 

means for generating said electronic representations of credit; teller means for issuing and distributing said 
electronic representations of credit; transaction means for storing, and for transferring said electronic 
representations of credit between other transacting means and between said transacting means and sa.d 

tel '%un?i« 8 'the present invention provides for a method of using electronic representations of currency or 
electronicrepresentations of credit provided by at least one financial facility having a means for generating 
said electronic representations, and a teller means for issuing and accepting said electron.c representations 
and serving subscribers of said facility, comprising the steps of: generating said electronic representations 
of currency backed by demand deposits or generating said electronic representations of credit authoriza- 
tions- issuing to said subscribers and accepting from said subscribers electronic representations of currency 
or credit wherein the issuance and acceptance is performed by said teller means at said financial facility; 
and providing said subscribers with a transacting means for accepting said issued electronic represent* 
tions of currency or credit, and for transferring said electronic representations of currency or credit to both 
other subscribers having said transacting means, and to said teller means. 

The present invention provides a method of securely transferring economic value including currency 
and credit among subscribers, among financial institutions, and between subscribers and financial mstitu - 
tions The system provided is a paperless system whereby transactions can be carried out in both an on- 
line and an off-line mode between subscribers. The system reduces the cost of central electronic funds 
transfer systems by off loading much of the payments to off-line devices. The system provides for 
inexpensive electronic transfers to reduce an institution's cost of managing paper cash, checks and coins^ 
Further the invention provides a user friendly electronic payment system that may be used reliably and 
securely for real time transfers of money between members of the general public, between members of the 
general public and commercial organizations, and between commercial organizations. The system may be 
integrated with a wide variety of data processing and data communication systems including currently 
available home banking services, Further, the system can be utilized with electronic money in the form of 
multiple currencies and in transactions of virtually any size denomination. Further the medium of economic 
exchange provided is fungible, easily transferable, undeniably redeemable, and secure from reuse, du - 
plication, and counterfeiting. . 

The foregoing features and advantages of the invention are illustrative of those which can be achieved 
by the present invention and are not intended to be exhaustive or limiting of the possible advantages which 
can be realized. Thus, these and other features and advantages of the invention will be apparent from the 
description herein or can be learned from practicing the invention, both as embodied herein or as modified 
in view of any variations which may be apparent to those skilled in the art. 
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Summa ry of Exemplary Embodiment 

To achieve the foregoing, and other objects, the methods and apparatus of the present invention 
employ a preferred embodiment in the form of an electronic - monetary system having (1) banks or financial 
institutions that are coupled to a money generator device for generating and issuing to subscribing 
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transactions with the on-line systems of the partc.pat, g ^ ^ ^ 

other like transaction dev.ces .n off - line Iran: ac ton* ( transaction devices to the issuing and 

correspondent banks, for process hand.. ^^^^^ correspondent banks themselves; (5) a 
correspondent banks, and for interfacing bet ^ een J h ^^ of tne diffe rent issuing banks; (6) a data 
clearing bank for balancing ^.^^So^^o all components of the system; and (7) a 

^^^ 0 ^ ^^ ^ — - - detSCtin9 COUnterfeiti " 9 ^ 

JTS — ent the functions of ^ ^ 
and the teller devices will be performed Nation is transmitted in an encrypted 

application software modules that may ^^^XTeMc money is transmitted with digita. 
form to provide security from "^^^^^Llon or counterfeiting. 

signatures to provide authent.cat.on, ^T^J^^ be an etec tronic representation of currency or 
The electronic money exchanged by these dev.ces .may equiv alent of bank notes and is 

credit. An important aspect of the e.ectronic cu rency ,s hat an jssuing bank> but can be 

interchangeable with conventional P?«.«™»*^ Respondent bank. However, only the issuing 
withdrawn or deposited both at an .ssu.ng bank an la a oo P 

banks can generate the e.ectron.c cu. ^^^^^ processes to maintain the monetary 

The issuing banks later utilize me ^ ban < ^£"8 bgnkj industry . 

balance in the banking system, as is currently p act.ced oy^ y and undeniably redeemable 

The electronic money ^-—^JS To ° f 

from the issuing banks, i.e.. they have th .chaw* J^.s xs ot m y a(ong ^ ^ jnformat , on 

the electronic monetary system. ^ * ^° cy (i.e.. dollars, yen, etc.) the amount by un.t of 

data identifying the monetary un.t of currency, and several digital signatures, 

credit or currency, and the bank .ssu.ng the electronic cred.t or 
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"^^ese and other ^J^^^^J^S «d 
presented. Some simplifications and ™^™££X£ion. but not to limit its scope. Detailed 

anow those of ordinary ski., in the art to 

utilizing electronic money inc.uding The tve^on comprises a money module for 

cash transactions, and electronic cred.t ^uS^'issuL distributing, and accepting the electronic 
generating the electronic money; a mone module e 9 , ectronjc money between other 

money; and a money module ^^^^J^^ 1 ^^^ the ^ ^ „ , 

accepting money modules sand between the acc ^ n m ° a 7 electronic monetary system is prov.ded for 

According to a further aspect of the inver « °"\ a " electronic currency that is interchangeable 
incrementing and maintaining e.ectron.c mo ^ o TbL nk an^ ect onic credi? authorizations, 
with conventional money through ^« ^TSrL* a genTrator for creating electronic money; teller 

The system includes a plurality of .ssuing banks, a 9 en ; r fJ and for irrter facing with other 

modules coup.ed to the generator modu.^ for ^pertomjng ^^Si of the e.ectronic money; a 
teller modules, such transactions .nclud.ng the t *^ n **™ monetary system; a clearing and settling 
security system for providing the overall .ntegnty o Suing banks and for clearing the 

process for balancing the e.ectronic -^^T^S^™ modules owned by authorized 

modules and the teller modules. functions of the generator modules, the 

hardware.™) application software m K a \^ e ™"°** d JTS ma, be an .l.etronio ..prestation ot 

„ rs\7zrrpS. b ^ m ,rr,:o,„ 9 jl „ — — ~ - 
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♦ with riinital sianatures to provide security from unauthorized modification or counterfeiting. In a 

^TeZZZTTeZ^ Z counterfeiting and tampering is aiso provided by requiring the 
and the Tndividua. unL of e.ectronic money to be renewed periodically. Offending modu.es or 
counterfeit electronic money can be removed from circulation as soon as they are discovered. 

Briefly a process in accordance with the invention comprises the steps of . . „ haHfBf1 h „ 

(iTproviding a generating module to generate electronic representations of economic value backed by 

S^^-S m^SSp. the generated electronic representations of economic va.ue and to 
issue the electronic representations of economic value; . 
ST^STthe authorized users with a transacting module for accepting, storing and transferring the 
electronic representations of economic exchange to other authorized users hav.ng the transacting module 

W ~t- P S^'i-n» te representations of economic value to other authorized users 
havina a transacting module and to the teller module; and 

^ providing a security system to allow the transfer of electronic representations of economic va.ue .n a 
secure manner between the generating module, the teller module and the transacting module. 

Brief Description of the Drawings 

Other objects and advantages of the present invention will become more apparent by the following 
description with reference to accompanying drawings, in which: 
Fiaure 1 is a diagram illustrating general aspects of the invention; 

Figure 2 is a schematic diagram of the operative arrangement of the components, according to the 

Figured is a perspective diagram of several embodiments of external systems that may house a money 
module, according to the invention. ..... *■ 

Figure 4 is a block form diagram of a transaction money module, according to the invent.cn. 
Fiqure 5 is a block form diagram of a Teller money module, according to the invention. 
Figure 6 is a block form diagram of a Money Generator module, according to the invention. 
Figure 7 is a block diagram of the network arrangement, according to the invention. 
Figure 8 is a block diagram of a Network Sever, according to the invention. 
Figure 9 is a flow diagram of the security system, according to the invention. 
Figure 10 is a block form diagram of a security server, according to the invention. 
Fiqures 11-24 are flow diagrams of accounting examples, according to the invention. 
Figure 25 a flow diagram of the Transaction Reconciliation System, according to the invention. 
Fiaure 26 is a flow diagram of the Clearing System, according to the invention. 
Figure 27 is a flow diagram of the Money Issued Reconciliation System, according to the invention. 
Figures 28-50A are flow charts of transaction examples, according to the invention. 

4Q Disclosure of the Preferred Embodiment of the Invention 

The present invention contemplates an improved monetary system using electronic media to securely 
and reliably exchange economic value. The system can be implemented by integrating novel data 
processing systems with other procedures which can be implemented with the current worldwide banking 

45 systems. ^ ^ descriptioni -electronic money" may also be referred to by the abbreviation "E-M " 
Additionally, the term "bank" is used hereinafter to indicate any banking, financial institution or the like 
which is a participant of the present invention. m-^i^^h in 

Referring now to the drawings, wherein like numerals refer to like components, there is disclosed in 

so Figure 1, in block form, broad aspects of the preferred embodiment. In Fig. 1, the general relationship 
among the features of the system is shown. The system includes Issuing Banks 1 each hav.ng a Teller 
money module 5 and a Money Generator module 6; Correspondent Banks 2 each hav.ng a Teller money 
module 5; an electronic money Clearing Bank 3; a Certification Agency 28 and a plurahty of Transact.on 
money modules 4 owned by subscribers of the system. 

55 Electronic notes 11. the media for transferring electronic money, are generated by the Money Generator 
module 6 for an Issuing Bank 1. These notes 11 are then transferred by a Teller money module 5 to a 
subscriber utilizing a Transaction money module 4. Electronic notes 11 may be representations of currency 
or credit authorizations. For security reasons, all electronic notes 11 will expire after a preset time period. 
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Once expired, the notes 11 must be redeemed at a participating bank for updated ones before they can be 

^^ArSuing Bank 1 generates and distributes the electronic notes 11. and is liable for their redemptior. 
An issuing Bank 1 performs deposits, withdrawals, payments to loans and .nquir.es for other money 

"^Correspondent Bank 2 is a participating bank which distributes electronic money through accounts it 
maintains at Issuing Banks 1, but does not generate any electronic money, and .s not ^ liable Jorrts 
redemption. Because it cannot generate any electronic money, the Correspondent Bank 2 ,n the preferred 
embodiment must make real-time requests of electronic money from an account it maintains at an Issuing 
Bank 1 whenever a subscriber wishes to withdraw electronic money at a Correspondent Bank 2. 

Conversely, a Correspondent Bank 2 deposits all electronic money depos,ted by subscribers, to the 
accounts the Correspondent Bank 2 holds at Issuing Banks 1. These accounts will be described hereinafter^ 
A Correspondent Bank 2, like an Issuing Bank 1. will perform deposits withdrawals, payments to loans and 

^NoSwTan Issuing Bank 1 may also be a Correspondent Bank 2 for the monetary units that it does ; not 
generate. For example, an Issuing Bank 1 for electronic dollar notes 11 may be a Correspondent Bank 2 for 

electronic notes 11 of yen. marks, issued by other banks etc. 

It is also important to note that system of the invention can function without correspondent Banks 2. For 
example, a subscriber can eliminate the use of a Correspondent Bank 2 by commumcat.ng d.rectly with 
his/her issuing Bank 1 when making a deposit, withdrawal, etc. Correspondent Banks 2 are .ncluded in the 
preferred embodiment for the practical purpose of expanding distribution of the system wh.le reducing the 
risks that are inherent in any banking system, such as the risks caused by the collapse of a bank issuing 

""^The Clearing Bank 3 is utilized when more than one bank is issuing electronic money. According to the 
invention, it is anticipated that more than one bank will be issuing electronic money. Thus, the C earing 
Bank 3 is provided to clear the electronic money deposited and to balance accounts it ma.nta.ns for the 
issuing Banks 1. The Clearing Bank 3 maintains demand accounts for each Issuing Bank 1 in the system. 

The Certification Agency 28. is the centerpiece of the system security, .t provides « process that 
"certifies" the validity of a money module for a certain period of time by issu.ng a cert.f.cate to each money 
module. A money module must have a valid certificate in order to be able to transact with other money 

""^Before the 6 certificate expires, it must be updated so that a subscriber can continue to use his/her 
transaction money module 4. This process makes users of the system establish penod.c contact w.th the 

Cert per!oTcSact allows for faster response when tampering with the money modules of the system is 
detected. To this end. the Certification Agency 28 also provides a list of offending or comprom.sed money 
modules to other money modules so that transactions with the bad units may be blocked. 

The components shown in Figure 1 are best understood by referring to the system's operate 
arrangement illustrated in Figure 2. As illustrated in Figure 2, the preferred embodiment provides .for 
supplements to the current banking systems that include the following add.t.onal components: a P uratty of 
the Transaction money modules 4. the Teller money modules 5. and the honey Generator modules 6 for 
creating, transferring and storing the electronic notes 11 (money); a Cleanng System 13 to balance he 
accounts of banks issuing currency and credit; a security system 21 to mamta.n the mtegnty of the 
SectronL notes 11; the current banking systems 20; a network 25 (exemplified by the lines '^connecting 
modules and systems) to mediate transactions between money modules 4.5.6, the part.cipat.ng banks i 2,3 
of system 20 and the security system 21; a Transaction Reconciliation system 22 to detect money module 
malfunctions and insider tampering of the system; a Money Issued Reconciliation fY*™™* **** 
counterfeiting and reuse of electronic money; and a Money Pos.t.on System 24 to keep track of the 

electronic money in circulation. 

Playing mayor role in the preferred embodiment are three classes of "money modules for creat ng, 
storing, and transferring the electronic objects that represent economic value. These include the Transaction 
money modules 4, the Teller money modules 5. and the Money Generator modules 6. It .s contemplated 
that these money modules 4,5,6 will be a combination of tamper -proof hardware and applicat.on software 
that are meant to be components of a larger processing environment. 

Referring to the top right-hand side of Figure 2. a Transaction money module 4 containing elec ron.c 
notes 11 stored therein (not shown) may be used to exchange foreign currency or make a payment w.th 
another Transaction money module 4, using a secure, encrypted protocol either by a telephon.c link, or a 
proximate communication link. Because it is contemplated that an electronic note 11 w.ll be fung.ble. ..e.. it 
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can be broken into any desired amount, the amount transacted between the Transaction money modules 4 
can De Dronen „uu a y , mnnnt stored in the payor's Transaction money module 4. 

may be of any «^ U P * ^^^Ci. received the electronic note 11 as a payment may. in 
A payee s Transact on money module 4 t ^ ^ M( subscrjber . 

SS^nS^S^ SSSr. the payee may deposit the eiectronic money into his/her ban* 
aCC °ThI'v al u e of the electronic money stored in the Transaction money module 4 may also be redeemed at 

ZTulZt^«* reZ an e q u„ amount o. paper money. N*ra,,y, « I. «"« 

- r ^:r£ r en.,n r ^ 
Teller money module 5 at an Mssu ng 1 o P ^ among 

1^ 1^^. nS^KS in current home banking systems). Upon a request to transact 
tTT^Z jZ ^ module 5 mediates the transactions for the subscriber's bank account as we., 

33 ^^^T^S^J^^ - -intain a bank account in order to own and 
,J\ Transaction money module 4. For instance, a subscriber may obtain a stand-alone computing 
SilTSS-TSn-caon money modu.e 4 and use the device only in off -line peer- to -peer 
^JLZs^th other devices containing a Transaction money module 4, such as a merchant s point -of 
sa.e ^ termor Of course, the merchant may then transfer the eiectronic money to another commerce! 
organization to meet its obligations, or it may deposit the electronic money at its own banlc 

In the preferred embodiment, electronic money deposited at any Issu.ng Bank 1 other th an the original 
, vL L„u 1 ikpM will subsequently be settled for value with the orig.nal Issuing Bank 1 through the 
cenTa'c^n ^ll ^llo^ by the Clearing System 13. .t is anticipated that the clea nn g 
=nn itt inn orocesses wiM be managed by the Clearing Bank 3 (Figure 1). Each Issu.ng Bank 1 Teller 
££%2£!Z£ all ^electronic notes 11 deposited at its bank but issued from other .ssu.ng Banks 
Tto the Clearing Bank 3 in order to settle for the value posted to their customers' accounts. 

WteTrMall an exchange for foreign currencies, an exchange of paper cash for e.ectronic 
mon^ or an updating of the electronic money occurs, the Money Generator module (Figure 2 creates 
and dually signs electronic objects having economic value - either currency or cred ' ™tfs 11 (F 9"e1> 
- that are to be sent to the Transaction money modules 4 through the partic.pat.ng bank's Teller money 
1 . r *f form nf a oacket of electronic notes 11. As mentioned above, the electronic currency notes 
TltHhe 2 oaTnotel tatTeUed by deposits, and can be traded between Transaction 

m0n SCt U he eS wthdrawa. transaction, the Teller money module 5 and the Transaction monev - module 4 
may esiablish a communications link using an encrypted protocol to securely transfer the notes 11 from the 
ah TpiiPr monev module 5 to the Transaction money module 4. 

Records o7°he notes 11 generated and conveyed by the Money Generator module 6 are sent to the 
^bank's Transact^ Reconciliation System 22 and an Issuing Bank's 1 Money Issued Reconchation 

45 C ^^XZS!7^^X system can be produced by the Money Position 

^Discrepancies and malfunctions are reported to the Security System 21 which downloads the lists of 
pro£" ^ Xney molleTto all money modules in the system when they are connected to the Network 2^ 
By crying thfs list, a Transaction money modu.e 4 will be inhibited from transacting wth other suspect 

50 ^^ZZ^^e. of the preferred embodiment, there wil. now follow a more detailed 
description of the individual elements and the transactions between them. 

Money modules 

Figure 3 provides several embodiments of external systems or devices for housing money ™<fu\es^ 
,n 9 the preferred embodiment, the external system or device will typically contain data d.sp.ay means 
data in P ut means, data processing means, memory storage means, direct connection or contact.ess 



10 



75 



20 



25 



30 



35 



BNSDOCID: <EP 0542298A2_I„> 



EP 0 542 298 A2 



70 



75 



20 



25 



30 



35 



40 



45 



50 



bidirectional communications means, and the money modu.e packaged in a tamper -proof housing, ail 
interfaced by suitable means for information transfer, such as are well known in the art. 

As will be understood, a money modu.e may be embodied as a modular component of any larger 
process^ environment whi.e stii, performing the same functions. For example. ^^^^T^J^ 
A may work as coprocessors embedded in personal portable comput.ng dev.ces l,ke the Hewlett Packard 
95™ cTas co-processors in mainframe computers, workstations, point-of-sale termmals or telephone 

^TeT™^ as a coprocessor in the bank, flnancia. computer 

systeml The M^ney Generator module 6 could be a separate processing unit networked to the bank a 
co-processor in a genera, purpose computer, or it may be combined with an Issumg Banks 1 Teller 

m0n B y ecrse" !l "ntiS^money modu.e wil, be implemented in a separate 

is assumed that corresponding interface circuitry wou.d be provided in the host processing dev,ce to 

provide communication between the processing device and the money module. _ 

Notably, all classes of money modules contemplated by the invent.cn may be .mplemented P«*™ 
matiSy or by direct electrica. connection through customized integrated circuits, or a comb,nat,on of both 
any of the methods known in the industry for providing the functions descnbed below wthout 
HpnLnn from the teachings of the invention. Those skilled in the art will appreciate that from the d.sclosure 
^^n^STiS!;. commercial semiconductor integrated circuit technology woulc . suggest 
numerous alternates for actua. implementation of the inventive functions of the money module that wou.d 
still be within the scope of the invention. 

Tran saction Money Module 

In one embodiment, the Transaction money module 4 may be imbedded in any computer °f any size or 
use, like those serving as general purpose computers or work - stations, to P^'^;^" 3 ..^ ™££ 
E-M transaction use This latter application will allow for such uses as real-time, off-line payments 
LweerirSna, computing device's or on-line payments for network services such as ^formation 
retrieval, telephone calls, or for purchasing airline tickets, theater tickets, eta 

in another embodiment, the Transaction money module 4 may be imbedded m an ,ndiv dual hand held 
intearated circuit unit such as a personalized hand -held computer that may be readily carried by an 
ndivd^aJ hc I g i were a wallet As an illustration, the device of the preferred embod iment mav r include 
^keyboard, a pen or stylus, a touch screen or voice recognition circuitry as a data .nput means, _ an 
iphaVumeric LCD dot matrix display as a display means, an infrared 

bidirectional communications means, and an RJ-11 telephone jack coupled to modem circuitry as a 
^phorcomlnications means. Additionally, the device may also include ^'3^?^^ 
and storaqe means for providing calculator capabilities, for storage and processing data of the owner etc 

ifStmpoTnt to note that the particular design of the external device is not critical to the mventaon and 
othe technologies suitable for accomplishing the foregoing functions may also be used. For example an 
LED instead of an LCD display panel may be used; radio, infra red. inductive or capacrtive communicat.ons 
methods may be used instead of direct connection, optical communications methods may be used, etc 

mgenera. it is anticipated that any Transaction money modu.e 4 owned by a -bs^ber wH be 
embodied in a self- contained, tamper -resistant unit that contains components which are difficult to 
access, and thus prevent any person from improperly examining, counterfeiting or mod. y.ng any of its 
conten s or arrangements. For example, integrated semiconductor circuits, whose contents a e diff curt to 
examine encased in a tamper -resistant package such as that formed by an epoxy or plastic lamination 
ZZoSe l w degree of physical security while providing the necessary storage, computation, t,m,ng, 
and other data processing functions. +h~,~ =»ro 

However, the invention is not limited to any particular tamper - resistance means, m*™*™*™™ 
a number of methods known in the industry for providing such security. Such tamper - res.stance wrtl a so 
prevent the owner, who can control only some of the internal operations of the Transaction money modules 
from certain accesses to thereby provide security from abuse to other relevant institutions and 



4 

individuals. 



55 



Each Transaction money module 4 will have a way of ensuring its own association with a particular 
subscriber, so that its use by other individuals may be limited. In add.t.on to the use 
.deification Number (PIN) methods that are well known in the art. the Transaction monejM ™ 
also include means such as a fingerprint reader, voiceprint analyzer, written signature analyzer, or other 
so-called biometrics means, to determine the physical identity of an authorized subscriber. 
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Additionally the Transaction money module 4 may utilize personalized interactive proofs using ques- 
tions ma on^ a true owner would be able to correctly answer, such as the owner's mother's maiden name. 
Ser tor fe cdor, etc. Any such techniques may provide additional security for organizalons and may 
a o be Z Z f advantage of the authorized user since such security can protect the subscribers data from 
inspection and use by someone else coming into possession of the Transaction money modu e 4. 

"Because the Transaction money module 4 can take on a variety of physical represent ations, ^ be 
described by the functions performed in addition to the pertinent physical charactenst.cs of a preferred 

^"Selrina now to Fig. 4, a Transaction money module 4 is shown diagrammatically in block form. 
SpedSy "a Transaction money module 4 has (1) an externa, interface 30 that interfaces 
money module 4 to the module's data processing means, the input/output means (human interface) and the 
communications circuitry of the external device; (2) a session manager 31 to control and commit (i.e., 
«nSTabort a transaction session; (3) a transactor 32 to manage application functions; and (4) a money 
holder 38 to contain and manage the electronic representat.ons of money. nratarrar i 
According to the invention, the following application functions may be .mplemented .n the preferred 
embodiment of the present invention: 

The To Subscriber application 33 performs the function of comparing the owner ident.f.cat.on char- 
acteristic s such as a user's personal identification number (PIN) and biometrics characteristic (e.g 
fingerprint' voiceprint, etc.). that are stored in the memory of the Transaction money module 4. to those of 
20 he I J who is attempting to gain access to the Transaction money module 4. After the proper 
owne sh p s verified, the Transaction money module 4 may be activated, and the user ,s a.k>wed certain 
accesses to the Transaction money module's 4 stored contents. Messages to the subscriber, and 
subscriber inquiries as to the information contained within the Transaction money module 4 are also 
handled bv this application function. 

The To Teller application 34 interfaces the Transaction money module 4 to the Teller money modules 5 
for initiatiH^nd-performing deposit, withdrawal, loan payment transactions, and bank inquiries w.th such 

Teller money g^*^^ 35 supervises the sending and receiving of electronic notes 11 between 
Transact ion money m odules 4, managing the process in which the electronic notes 11 are . proper V 
"packaged" as to amount, digital signatures, etc. This application prov.des that the electronic notes 11 1 are 
transferred in a recognized, valid format. Notably, this is the application that allows a money module to 
P ^ and foreign exchanges. Without this application in the preferred embod.ment, a 

Transaction money module 4 cannot make a payment to another Transaction money module 4. 

The Tran Log Mgr. application 36 provides the management and overseeing of a log that records 
complete d transactions u ndertaken by the money module. For each completed transfer of electronic money, 
an illustrative Tran Log records: 

(1) the type of transfer (i.e., payment, deposit, foreign exchange, etc.), 

(2) the date of transfer, 

(3) the amount of transfer, 

40 (4) the Issuing Bank 1 identifier 
(5) the note identifier, 

(7) the idenS other money module involved in the transaction, and for deposits, withdrawals and 
loan payments: 
45 (8) the bank account number, 

(9) the bank identifier, and 

(10) the amount of the transaction. ^ rt+ i fi£i . 
In the preferred embodiment, every money module will have an identifier. A money module fdent.f.er 

may be thought of as the "serial number" of the money module and is never changed. 

It is anticipated that a subscriber may have access to several of the fields of data stored in the Tran Log 
application, such as histories of the amount, date, and type of transfer. Information as to the expiration date 
of a certificate may also be accessed by the subscriber so that he/she will be informed as to the need to 
update or revalidate the money module's certificate. 

The Maintain Security application 37 manages a list of money module identifiers that are known to have 
55 been ge nerally compromi sed. In particular, this is a list that is distributed to each money module when it 
communicates with the Network 25, and is a list of money modules that have passed an mvalid or 
counterfeit electronic note 11 or have performed acts deemed detrimental to the system. 
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When establishing a session between money modules, each money module checks its list of bad 
rno^Z^TSe if the other is an offending money module. If the other money module's .dent.f.er 
ann pa r c D n the list the communication is broken off. 

'This apScatL also provides the process for obtaining the certificate unique to the money modu.e. for 
synchronizing the internal clock, and for managing the creation of new cryptography keys. 

" Note Directory 39 application performs the function of keeping track of the location, ,den if.cation 
and 111 ^oMhe electro nic notes 11 stored within the money modu.e. A note 11, whether ,t is an electronic 
cufren^y note or an electronic credit note, is the basic unit of e.ectronic money. It ,s the el ectr-,c ob ec 
rep esenting the economic value, the electronic bits that contain the amount, exp.ral.on date note , dent. fter 
etHdescrLd in detail below) that gets digitally signed (described below) and encrypted when being 
transferred. Both electronic currency notes 11 and electronic credit notes 11 may be located by the Note 

Dire Th 0 e y Not Directory application 39 updates summary totals of the current amount of electronic notes 11 
(both currency and credit) by monetary unit after every transfer. A date - of - expiration, a note identif.cation 
number and an Issuing Bank identifier is also recorded with the location of each note 1 . 

In summary, the Note Directory 39 keeps track of the note idenM.cat.on number the Issumg Bank 1 
identml Te date - of - expiration of the note 11. the location of the note 11 as stored .n the Transaction 
money module 4, and the current amount of the total value of the notes 11 stored for each ^monetary - umt 
These "records are maintained for both electronic currency and electronic cred.t. For a cred.t note 11. the 
account number of the credit line is also maintained. 

The Notes application 40 manages the storage of the representations of the e ectron.c notes 
themselvelTboth currency and credit notes 11. This application also generates the transfers when notes 11 

TheVaTkeTManager application 41 manages the construction and formatting of a packet of electronic 
notel 1l that are to be transferred to another money module. For example, the Packet Manager 41 will 
utiE an S r*hm so that the least number of electronic notes 11 are used to fulfil, the requested ; amount 
o ransfer with the earliest dated electronic notes 11 being used first. Alternately, when a packet of notes 
?1 s transCd to the receiving money modu.e. the Packet Manager 41 application "d.sassemb es the 
ll£eT?e%in 9 the date and separating the data fields that represent the different e.ectron.c notes 11 

The formatted packet gets several data fields appended to it when electronic notes 11 fe 'assembled _ 
An Z>ZTZa field provides the indicia that identifies it as a packet. Additionally, data tields for the total 
value of the notes 11 the number of notes 11, and the individual locations of the notes 11 are prov.ded. 

ThrJLmer appI cation 42 verifies that a received packet contains valid e.ectronic -tes 11 before a 
recelinq-So^iy module accepts them. The Verifier 42 also checks that the total amount rece.ved .s equa 
rfhe sum of the electronic notes 11 that are to be transferred, .f the total amount and the .ndw.dua. 
Sectranic notes 11 are valid, an acknowledgment is returned to allow for completion of the transfer. 
Otherwise an "invalid" message is sent, and the transfer may be aborted. 

sT^Tces applications that are provided fall under two categories: Clock^er 43 and Cryptography. The 
ClocTOiT 43 P proles output pulses for control.ing a transaction timeout, such as the time between the 
sendina of a message and the return of a corresponding message. 

As J be appreciated, when two money modules are communicating, they may be monitonng a time - 
out protocol. For example, after a first money module has sent a message to a ^cond money r 
Session Manager 31 of the first money module ("A") may set a timer for a reply if the Transactor 32 
fnd^estha^a reply is required. The Session Manager 31 may also number the message sent. Th.s 
^S^ol s^r in the reply message from the Session Manager 31 of the second money modu.e 

rB ?f the timer expires before the message has been received, then Session Manager A 31 will query 
Ses ion Meager B P 31 to determine if the Transaction is still running in B. If B does not reply -ttmn Session 
Manager A 31 will abort the transaction. If a reply is received that the transaction ,s proceeding, hen the 
tTmer will be reset to a new time. If A queries B a predetermined number of times without rece.v.ng a reply 
to the oriainal message, then A may abort the transaction. 

Sepa?ate.y. this application also maintains the current date and time, both for user d.sp.ay and for 
verify^ Tthat an e.ectronic note 11 to be received is not an expired one. a.ong with other genera, clock 
functions that are commonly used in the industry. 

The Cryptography app.ication contains a Pub.ic Key 44 operation, a Symmetr.c Key 45 oP^.on^and a 
Random Number gen erator 46. While the tamper - resistance of the Transaction money module 4 and .ts 
components makes it difficu.t for a person to modify the structure of the dev.ce or '"J"*"**^ 
cryptographic techniques are also employed to provide secure commun.cations and payment transfers 
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between money modules employed by this application to provide 

^J^oT^^n money module with the ability to checK the digital signature for 
authSfcity' A mTney modu.e receiving the digitally signed electronic note 11 can ■„ turn s.gn and transfer 

thought to be feasible to decipher and duplicate them within a feasible period of t,me, mak.ng such a 
security system resistant to forgery. . . 

Lastly this application also creates new public and pnvate keys when needed. 

SvmLtric Key cryptography 45 provides private key algorithms that are well known .n the art. for 

£ ScSna Ste«S in providing cryptographically secured communications, manufacturers are proving 

S ufseTc^ P°*°- the r o irrdaC\vaia fe 

I , * + -™<e rinFP data enervation devices are examples of commercially avauaoie 

2£*£S£X -SS tha^ou^'suitable in ,h. present M tor 

Sly mandated use ol the DES algorithm, devices such as these are ».dely utbzed to implement that 
'"f important to note that the details ot the particular cryptographic methodology utilized by the money 

cSTfor providing such random number generation capability are well known m the art. or 
■ t <~o n i-Jruit Irtilizina a "noisy" diode may provide random values, as is well known in the industry. 
Random number may also be ^provided by a pseudorandom number generator circuit which implements a 
maCSalg^ power -residue algorithm, that generates apparently random values 

SSTS-TS The use of clocks or counters provides another often used source of random data 
As wm be understood the Random Number Generator 46 may use techniques that are well known to a 
person of oSSTSb in the art to generate the temporary numbers, and thus need not be further 

^"should be further understood that the foregoing functions disclosed herein may ^ performed by 
known programming techniques and/or dedicated hardware and in some cases may be comb.nat.on of both 
o^hareTesou^from each. As may be appreciated by a person skilled in the art 
and detail can be made in dependance on specific application requirements without departmg from the 
essential features of the money modules. 
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Teller money module 



The banking systems 20 of both the Issuing Banks 1 and the Correspondent Banks 2 
svstem of the invention through a Teller money module 5. The Teller money module S may be ""bedded .n 
anTgeneraT purpose computer or workstation. The particular design of the Te.ler money module 5, hke the 
Transaction money module 4. may be implemented in readily known programm.ng 

computer hardware, or a combination of both. As will be appreciated by a person sk.lled n the art various 
Z^o^e Tener money module 5 may be employed to implement the *<r*%**^^ B Tne 
The details of one embodiment of the Teller money module 5 .s shown m block forrr . m F.gur 5^ The 
Teller money module 5 contains many of the same components and appl.ca on ^^^^^ 
monev module 4 described above. Therefore, the identical components will only be repeated bnefly here. 
SSTiSlSniSnB components wil. be fully described. It should be noted that the TeH-rnw 
module 5. like other money modules of the system, is also contained within a tamper-proof enclosure of 



11 



; <EP 0542298A2_I_> 



EP 0 542 298 A2 



10 



15 



20 



the type common in the industry, so as to "J^necsjj* ry JJ s J5^ anBBer 3 1, a Transactor 32 
and T^ SC—i: "re corresponding components in the Transact,on 

communion, means within the teller money mod le ^ Teller money modu.e 5 and 

controi and commit (i.e., finalize) or abort * *^ c * on ^Xi ng and retrieval of electronic money; and 

srr^^n^ a ^^^^ - * - — ■ 

- Padret Manager 41. Manages * assembly - — ** - • <— ' » " — ~" * * ^ 

- S^^m-.^.P^^^rSf^i ,„e electron* row 11. 

- Clock/Timer 43: Controls transaction timeout exp.ra»on ot tn. 
, ewiration ot the certificate, and general clock funaons. 

" pSC 44: used ,0, sign.tu,.. .0 * and -date notes 1 1 and to se, up a secure transaction 

« lyrn'metrio key 45: Controls the seourity ot a •™"»*"^ n fer „,„ ^p.ograpnic keys. 
,,!, fLdom number generator 46: Genera»s •fi^ J '^£ZJ%> applications. Tne To 

^rsKi'srsrr - - — - *• - — 

35 being requested. DerT orms deposits, withdrawals and payments to loans. This 

J^^^e^rX^^^ S is transact with a subscriber. Transact 

™"Z rented above, a TeHer money Tco^Z X 1 » I 

40 correspondent Bank 2. When Teller money module i i assoc. ated & Transac , on 

utilized for intermediating deposits, ^g^^™?^^ an Te.ler money module 5 at an 
money module 4, the Correspondent Bank s 2 on line systems, 

Issuing Bank 1. Teller money module 5 is used for intermediating 

When operating in an Issu.ng Bank 1 mode the ™ le ' ™ n J mQ modules and the Issuing 
45 deposits, withdrawals, and payments ^ey modS 5 is performing in an Issuing Bank 

^tX^ 

e ,r2S:=S ?£X£ mod 9 U ,e S to a Money Oenerator Module 
80 6 ♦ ^rtnrmpH in an Issuing Bank's 1 Teller money module 5 are essentially 

barter sirsisss:- sa- «— -~ 

Money Generator Module 

55 ^^o^agram --«^ « ^1^"^ 
Sroen"d^t package to, «. earn. , reasons 
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stated ^ f °^^ the electronic money (in the for. of J^"^^ 

described in further detail below), and distributes them to other money modules through the Teller money 
mod le 5 o In Issuing Bank 1. The Money Generator module 6 inciudes a unique app.ica.o " not Preset ,n 
5 other money modules for responding to requests for electronic money. Th,s .s the Money Creator 

aPP T C he 0 Mo 5 n 0 ey Creator application 50 creates and formats the electronic objects representing value - 
eiJr cu rlcy backed b y demand deposits, or credit authorizations - and digitally signs these -*ec£mc 
notes 11" using public key cryptography in conjunction with its secret key, so that ,t may be sent to an 

in Issuina Bank's Teller money module 5. , 

Notably, in a Money Generator module 6 the To Bank application 47 notifies the bank systems of any 
irreoularities off-loads transaction records in the Tran Log to the Transaction Reconciliation System 22 
Z T^ers electronic notes 11 to the Money Issued Reconciliation System 23. A of the other 
applications of the Money Generator module 6 are identical to the sim.larly named applications of the 

is money modules described above. 

The Network 

According to one embodiment of the invention, the individual components of the present invention may 
20 communicate over a Network 25. as shown in Figure 7. The Network 25 will link together the Issu.ng Banks 
1 Correspondent Banks 2. the Clearing Bank 3 and the Certification Agency 8. 

' Transaction money modules 4 may be coupled to the Network 25 over the telephone exchange or v,a 
special terminal facilities at bank locations (e.g.. additional contactless or cable connect "ons at an ATM 
booth). A communication layer will carry transaction requests (e.g.. deposits, ^drawals), packets of ^notes 
1? and new certificates securely across the Network 25. In the preferred embodiment, the Network 25 w.ll 
also provide directories of financial services, and update the money module clocks and the bad money 

module list of all money modules. . 

As will be understood, the Network 25 may use well known data link or communications systems and 
techniques that utilize, for example, telephone lines, fiber-optic land lines, and satellites and that include 
connective, timing and control software and circuitry for allowing access and transmitt.ng dig.tal information^ 
The Network 25 may use commercially available protocols and operating techniques such as those set forth 
by the International Standards Organization ("ISO") for Open Systems Interconnect network standards. It is 
important to note that the particular design of the Network 25 is not critical and suitable technologies for 
accomplishing the foregoing data communications functions may be used. 

Each entity (Banks 1 and 2, Certifying Agency 28, or Clearing Bank 3) is also assumed to have an 
individual local network 16, 17. 18 and a gateway to the larger system Network 25. The larger Network 25 
will provide directory services for the routing of messages to connect to the appropriate local network 16, 
17 18 The local network 16. 17. 18 has the responsibility of routing messages to the correct money 
module or Security Server 27. A Security Server 27 is associated with each participating bank and the 
Certification Agency 28, and is used for implementing the security of the system. 

Figure 7 illustrates the preferred embodiment of the Network 25 generally, indicating that money 
modules of any participating bank may be intercoupled to the money modules of other banks and financial 
institutions or another subscriber's Transaction money module 4 via a communications link directly 
connected into switching and processing centers and alternatively connected to a local network 16. 17, 18 

45 at each entity. . ... u i 

A money module need only identify the local network 16. 17, 18 destination (typ.cally a bank 
subnetwork) for the transmission of most messages. The local network 16, 17. 18 will route the message to 
an appropriate money module for establishing a session. Once a session is established, the Network 25 
directs all messages between the two money modules. The Network 25 also controls messages between 
so money modules and Security Servers 27. 

Transaction money modules 4 may communicate over the Network 25 for depos.ts, withdrawals, 
payments to loan accounts, updates or inquiries. The Teller 5 and Money Generator modules 6 will sign on 
the Network 25 periodically to update security information. The sign -on will be initiated by the money 
module Session Manager 31. or by the bank Security Server 27 if recertification is required or if there are 
55 changes to the bad money module list. 

A bank services directory may be available to the money modules primarily for updating the electronic 
notes 11 and performing foreign exchange. A list of participating banks for either service will be available 
from the Network 25. 
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ln the preferred em— the ^ .^J^C^^ 
ScSZ? r^^TlS^^ Sin the Network 25 every time that the respective money 

m ° d NetwTr S ?rve?s%TZU 5 vide the money module services described beiow, and gateway services to 
the loc* nLork m*17™ SVIhe app.ication functions of the preferred embodiment of the Network Server 
26 i^hown in the block diagram of Figure 8. The foi.owing application functions are contemplated for the 

N6 n )t«eZ interface 56 - a communications layer which interfaces to the Network 25; and 

S toZ^o" Session Manager 57 - manages a communication session between money modules, 
and between a money module and the Security Server 27. 
AoDlication Services are provided by: 

(3) Manage Network Sign - on 58 - controls the money module Network s.gn - on process 

<4> Synchronized Tim^Date 59 - keeps money module Clock^mer 43 services synchrony to a 

(sTRoutfMessage 60 - directory services for routing messages, controlling message routing during 
<;inn - on and durinq a money module session; and ^ . . rt 

^ Direct to Bank Services 61 - provides information on services provided by part.cpat.ng banks. 
^ w^bl appreciated by one skilled in the art, switching and processing centers that are known ,n the 
indutTry may bemused to enable the networking cooperation between a financial institute and any other 
that is coupled to the same centers. 

Electronic notes 

We turn now to a further description of the elements of the electronic notes 11 themselves. 
M StronTc currency note 11 representing value is essentially an electrons object created from a 
transactror eauest (deposit or withdrawal) which is backed by demand depos.ts at an Issuing Bank 1. At 
various time and Tin various points of the system, the notes may appear in electrical or magnetic forms ^o 
ITetec^Zt^c radiation. These notes 11 may be transferred over several transacts 1U st l.ke paper 
ZteTZ VLnon* property of fungibility that allows the electronic notes 11 to be commuted and 
transferred in amounts less than or equal to the value of the note 11. 

Notes may be split by appending a transfer record to the note 11 and signing the note 11 using tt» 
pnva^rcryptographic key of the money module transferring the note 11. E.ec r on«cn*tt» tes 1 £ 
Sever can only be transferred once in the preferred embodiment, because .t ,s antic.pated that rts 
receiver must deposit the credit note 11 so that the loan may be realized. 

Cred^ notes 11 unlike currency notes 11 are drawn on a subscriber's loan account. Each cred.t note 11 
carried the accoun 'number it is drawn on. The account may be a revo.ving credit or credit line on which the 
note 11 i draw operating much in the same way that a check or a credit card account works m todays 
banking ndusTy Credit notes 11 can represent a part of or all of the credit line of the account. 

tfh ^ pre e'r ed embodiment, the credit notes 11 can only be transferred to anot ^ T ^ 
modu.e 4 by the owner of the account, and the receiver of a credit note 11 can only deport . «toh» £ 
Z account as currency. From there, the credit note 11 is cleared with the currency at the Cleanng Bank 3. 
The subscriber's bank recognizes the loan upon receipt of the cleared credit note n. nrBttmH 
in cS notes 11 are withdrawn, they do not trigger any accounting transacts '" the preferred 
embodiment. Current credit line processing may to be modified to keep track of the amount oT the credrf 
^ in the subscriber's Transaction money module 4. Whenever the subscnber commun.cates with the 
ssuing Bank 1 maintaining the credit line, the amount of the credit line in the Transaction r m«ta*4 
is removed and replaced based on any adjustments to the credit line m the £ T ° ta ' Cred,t 

notes 11 plus outstanding loans must be less than or equal to the total amount of the cred.t l.ne. 
so Electronic notes 11 are comprised of three collections of data fields, namely a Body group a Transfer 
group and a signatures and Certificate group. The Body group of data fields includes the following 

,nf °(lTthe type of electronic note 11, i.e., whether it is a currency note 11 or a credit note 11; 
(2) the Issuing Bank's 1 identifier; 
ss (3) the monetary unit identifier; 

(4) a Note identifier; 

(5) its date -of -issue; 

(6) its date -of -expiration; 
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(7) the subscriber's account number (used only for credit notes 11); 

(8) the amount or value of the note 11; and 

(9) the Money Generator module 6 identifier. 

The Transfer group of data fields includes: pnrrpnrv 
(1) a toL of the number of times that the electronic note 11 was transferred; (provided for currency 

Ta JstoMransfer records that indicate to whom the apportioned note 11 was transferred from, the 
date -of -transfer, the amount transferred and the identification number of the rece.ver. 
The Signature and Certificates group of data fields includes: 

(1) the digital signature of the Money Generator module 6; 

(2) the Money Generator module 6 certificate; 

(3) a list of payers which contains each payor's signature and certificate; 

(4) the digital signature of the payor; and 

^^TZIJ^X^^ and the certificate of the chain of the transferred payments 
oo^TZ e^oTnote 11 sent; the'remaining amount of the note 11 is recorded in the Mote D.rectory 

M - an electronic note 11 is determined by the vaHd^the 

dioital sZture of the Money Generator module 6, and the validity of the signatures of past payors <rf 
Xnt) Any Tnconsistencies in this information will case the transfer of any electronic notes 11 to be 

ab0 7ts also important to note that as a security measure, notes 11 will be valid for a limited time, up to its 
! h^p An Txnired note 11 cannot be transferred, it must be updated by transact.ng with a 
TaSa ngtanrxo th end wheler a Transaction money module 4 performs any transaction with a 
j^e^Zy modZ 5. all of the e.ectronic notes 11 stored in a Transaction money module 4 will be 
Sns e^ to me Teller money module 5 so that notes 11 may be replaced with updated I ones before they 
expire This security procedure also helps to keep offending notes 11 from being crculated broadly. 

As wil be understood, every time that a note 11 is transferred to another money module, a d.grtahy 
signed Cfer record indicating from whom it is transferred is appended Thus, the rec.p.ent of an 
electronic note 1 1 will also receive a record of all of the past holders of the note 11. 

To?l^, a $50 e.ectronic note 11 may be generated, and withdrawn by a Transaction money 
modute 4 Assuming it is transferred to other money modules in $10, $10 and » 
^iont mnnov modules will receive the note 11 with the transfer record identifying the first Transaction 
money module^ ^Wht a ec plent of the $10 note 11 transfers $5 of it to a third party the third party 
Te^e tne note 11 along with the record indicating the previous two holders. Assum.ng this $5 note 11s 
hen deoSec^ la record of it will be matched with other segments of the original $50 note 11 that find there 
way bS She bSg system by the c.earing and reconciliation processes of the present embod.ment 

Only he receiver of the transferred note 11 can either deposit the note 11 or use ,t ,n payment The 
VeriS of a money module is used to check the signature of 

the note 11 is valid and to verify the identifier in the last transferor as the current holder of the note 11. This 
SarS the ew holder of a nole 11 from trying to use a value greater than that which was transferred. It 
adhibits copying notes 11 for use in another money module since the .dent-f.ers w.ll not 

can be appreciated, a subscriber may be able to access certain information about the electronic 
nntA«? 11 stored within the Transaction money module 4. 

.n aSr he subscriber may be able to select information on the total amount of the electronic 
notes 11 slored: the monetary unit <tf the notes 11, the type of electronic notes 11. i.e., currency or credit, 
and the denomination of each note 11. 

System Security 

The security of the system is maintained by the participating banks and the Certification Agency 2ft 
which creates and distributes money module certificates. A certificate of a money module ,s actually a the 
money module s identifier, its public key, a digital signature of a money module's identrfier and publ.c key 
cTrtificXy key (described below), and the version of the certificate^ key. The certificate ,s unique m that .t 

55 " - rSE£En° Z^^*~™ - — modules to validate each other prior to 
transacting, first by controlHng the money module certificate process and second, by d.stnbutmg a l.st of 
bad money module identifiers. 
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in the preferree embodiment, the money module certificate will be initially loaded into the money 
m Jul* hv the Certification Agency 28. The Certification Agency 28 generates the certificate for each 
I X a celcLr/key (a private key of the Certificate Agency 28). It may be changed 
ScSly and distributed under version control processes that are commonly used ,n the industry As « II 
br a pprecLed every money module wi.l store several versions of the certificatory key .n order to venfy 
certSes created by an oider key. Because it is anticipated that certificates wil. expire over t,me, ,t ,s 
exoected that only a few versions need be kept. 

A certifLte will only be valid for a limited period of time after its creation. Upon exp.ration of the 
certificate the money module will not be allowed to transact with other money modules. Any money 
m^uS discovered to have been tampered with wil, be limited in the amount of damage that they can do 
to the system since their certificate will not be updated. mnrt „, aa 
To block offending modules from transacting it is also desirable to have legitimate money modules 
receive the latest list of offending money modules soon after the list is updated Natur ally thjs requ.n ^ ha 
Transaction money modules 4 access the Certification Agency 28 on a penod.c basis to obta, he late* 
.ist Placing a time limit on the Transaction money module's 4 ability to transact (,n add.tion to the time lim 
pteTon electronic notes 11) will force subscribers to access the Certification Agency 28 through the 
Network 25 on a periodic basis to receive the latest bad money module list along with the a new certificate^ 
Advantageously, the period of the certificate validity can be closely monitored and adjusted according to 

360 The Certification Agency 28 distributes its updated certificatory key and money module certificates on - 
line through the Security Server 27 (see Figure 9). An important component of the system s security .s 
p^vided by Security Servers 27 at the participating banks and Security Servers 27 at the Cert,f,cat,on 

A9e Re y fe^ing now to Figure 10, a biock diagram of a preferred embodiment of ^^^^ 
shown. It is contemplated that the Security Server 27 at the Certificate Agency 28 or on a bank s local 
network 18 will contain the following application functions: 

(\) External Interface 54 - a communications layer for connecting to a bank's local network 18 or the 
Certification Agency's local network 17; 

(2) Session Manager 55 - controls the security aspects of a transaction session; 

(3) Create Certificate 50 - certifies a certificate for any of the money modules; 

4 Create Account Profile 51 - certifies and signs a bank account profile <de scribed in debul 
hereinafter) that allows a Transaction money module 4 to access the subscribers d.fferent bank 

S C SrLte Certification Keys 52 -distributes the Certification Agency's 28 list of valid public keys to 

35 the money modules; . 
(6) Bad Money Module Control 53 - controls and distributes the list of bad money modules; and 
7 Services - identical to the cryptographic functions 44, 45, 46 in the money modules descried above 
Since certificates will expire over time, money modules will be required to apply for new creates 
periodically. In order to receive a new certificate, the money module creates a new publ.c key and private 
key. The new public key, the money module identifier and the old certif.cate are presented to the 
Certification Agency 28 after being digitally signed using the old private key. 

The Certification Agency 28 checks the signature and if it is valid, signs ^ "ew public key and 
identifier and sends the certificate to the money module with a future ^P ,ratlon ^ ptw ^ k ^tSS? 
Agency's 28 Security Server 27 also distributes a list of bad money modules v.a the Network 25. Initially, 
each participating bank's Security Server 27 reports the identifiers of money modules which hole I notes 11 
fnvalidly or that are counterfeit. Those identifiers are passed through the Security Servers 27 and are 
compiled by the Certification Agency 28. 

All such identifiers are distributed to the Teller and Money Generator modules 5, 6 respectively A 
money module will not transact with another money module found on the list of bad money modules^ 
Optionally, only those money modules which have demonstrated a flagrant breach of secunty w.ll be 
distributed to Transaction money modules 4. 

If a Transaction money module 4 is lost or stolen, the subscriber would report it to his/her bank or to the 
Certification Agency 28 so that the money module identifier may be placed on the bad money module list 
to inhibit any further transactions. M ^ tnn 
While the security of the system is provided by being able to block a money module from transacting, 
system security is also maintained by providing the expiration date on the electronic notes 11 in add.tion to 
the money module certificates. 
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i , * rw* 11 witri be valid only for a limited time period after it is generated. Its 
period of valiMy of a note 11 can be « ed By » vauje „,„„„, „„ te be set „ expir e ft, 

^rri^r^j^^^.^ «— • — • - • - 

„„,a „ may b. set to .xpire ^f^^SZSSZTt* can deposit o, e-chang. tn. notes 

a. sia n l „ 9 «.-lo U aPIN.«o m .,rio.o r o^ „ odute 4 

coSns any .laconic not.* 11. In either of these cases, the Transact™ money module 4 w.ll ,„KM the 
subscriber from securing the modulo with naw secret information. ,,, b ,„iKe, 
. ,h. Transaction money ^JZ^aZfXXTX 
ScST. : ^TJESt%££^^ 4 Larns the subscriber, J. 
^r!nnTlfzation has been completed, subscriber access to the Transaction money module 4 requires the 
success uTr mp Te ion of a sSn^n in which the secret information is presented to the Transaction money 
module 4 lUhe subscriber can sign on to the Transaction money module 4, then he/she w,l, be perm.tted 

te TS^t^5SSTh- forgotten his/her P.N or had an incident which has affected 
his/ht bVmetr reading, then the subscriber may take his/her Transaction money module 4 to a 
oSSoX Tbank A special transaction may be executed which deposits any electrons notes 11 m a 
hoSinraccount and destroys the stored bank account numbers. The subscriber can now enter new secret 
s°gn-on numbers and characteristics. Any electronic notes 11 that were removed 
Transaction money module 4 and the banK account numbers may then be recreated (see Bank 

^Tsho^dTi'noted that it is not a requirement for a subscriber to identify himself to the system when he 
takes Possession of a Transaction money module 4. Though the identity of the money module .s contained 
f everinsTction the holder of a Transaction money module 4 can be kept secret. If the re afonsh.p « 
nZZ toen wecoM trace all of the transactions of a subscriber for the period that the relationship can 
SnnoSraSrte only time a subscriber must reveal his identity is if he/she links the money module to 
a hank arrount or wishes to redeem money lost. 

.fthrsubscJber chooses to use the Transaction money module 4 only for payments and foreign 
exchange then he/she can keep the relationship secret. As may be appreciated, the subscriber may also 
acaufre a pltTrX of Transaction money modules 4 and, for example, link one to bank accounts and 
maTnSn the oCs for anonymous payments. The other Transaction money modules 4 may be loaded w.th 
notes 11 by exchanges with other money modules or by exchang.ng for cash notes 11. 

Re placement of Money Module Value 

If a Transaction money module 4 malfunctions or is lost or stolen, it may be possible for the subscriber 
to recouX va ue t h at was stored in the money modu.e at the time of the incident. Th.s would ^necessitate 
SJ^terlber relinquish the option of anonymity for that money modu.e. smce upon , making c a,m for 
he lost money he/she would have to verify that he/she is the owner of the Transaction money module 4 

To pTovide for the replacement of electronic notes 11. the subscriber may first link h.s/her faction 
monly modu.e 4 to a bank account or register ownership of the Transaction money moduto 4 w* the 
Certification Agency 28. After every transaction invo.ving the transfer of electronic notes 11. the subscriber 
Su^Se the Tran Log. which identifies the counterparty money module identifier and the note identifier, 

st ° ra 9 e which is removab,e from the host computing env, :° n T Th,s 5 

Z^S^Zm by the subscriber when making a claim to replace value. The log may then be compared 
to reconciliation files to determine the true value of the lost electronic money. 
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An alternative to this procedure would be to refresh the money in the Transaction money module 4 

ransacln recorts at the issuing Banks 1. The existence of the notes 11 could be venfted by scann.ng 

theS A f ihird alternative would a.low the system to capture a money module's Tran Log when money is 
refreshed These records would be copied and routed to Issuing Banks 1 for storage on the.r transacts 
histories. The existence of the notes 11 could then be verified as in the previous alternate. 



Bank Access 

According to one aspect of the invention, a customer's Transaction money module 4 may access 
deposits, withdrawals, transfers, etc., at any bank participating in the system and ,n 
palLr any ba nk h0 ,l g an account with the subscriber. For instance, a typical subscriber may have a 
savtgfacco'unt and a checking account at one of the participating banks, while manta,n,ng 
money market account at a separate financial institution, and perhaps a credit-l.ne account at a third 
participating bank. It is anticipated that a subscriber's Transaction money module 4 w II access h.s^er 
accounts for deposits, withdrawals, loan payments and inquiries at any bank or f-nanc.al .nst.tut.on wh.ch 
can be accessed through the Network 25. 

.f a subscriber has multiple accounts, the subscriber's account relationships wrth a bank will b -stored 
in an account profile in the To Teller 34 application of the Transaction money module 4. The multiple 
ZZnteZ J be linked together by the personal account number ("PAN") associated with the md.v.dual 

SUb T C he account profile may be created either in person, under the control of a bank subscriber « jrvice 
representative at a branch, or over the te.ephooe utilizing a special dialogue For exa mp.e the sub scnbe 
may identify himself by his PAN and PIN. He may then enter each account ^'^f^**™^ 
from his Transaction money module 4. The account numbers may be verified .n the banks account 
reference files. A cross-reference of accounts to Transaction money modules 4 may be ma.nta.ned by 
each bank if they so choose. 

The composition of an exemplary account profile may be: 
30 (1) Bank Identifier - - one for each bank; 

(2) Account Numbers; 

(3) Account Types - - e.g., checking, savings, credit; and 

(4) Security Server's 27 signature on the list of accounts. 

H wi!Tbe understood that the list of account numbers will be digitally signed by the bank Security Server 
35 27 As a further security measure the account profile may be re-signed with an updated public key on a 
plriodic basis The fundamental access security is provided by the digital signature of the bank's Secur.ty 
Server 27. 
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Banki n g System (Accounting Architecture) 

It is an notable feature of the preferred embodiment, that the method of the system can parallel the 
existing and varying types of accounting methods that exist today. The system of the preferred embodiment 
"olows ?the various types of accounting methods practiced presently in various banks. However, it .s 
mportanMo note trJ'un.ike the present banking system, in the preferred embodiment of the invenfcor, 
economic value is created on demand. Thus, there is no inventory of cash or checks mvolved; electrons 
currency from demand deposits an e.ectronic credit are created on a real-time basis. This ^r"™*- 
paper inventory by using an electronic media of exchange requires certain supplements to the commonly 
practiced accounting techniques to provide the real -time accounting needed. _ lome „t 

Accordingly, the embodiment of the present invention provides an accounting structure to supplement 
those used in the present banking systems 20. The improved accounting arrangement may be > utnized to 
monitor the electronic money and each bank's obligation when a financial transaction between a Transac on 
money module 4 and a Teller money module 5 occurs, or when a Clearing Bank 3 performs any clearing 

PrOC Zn electronic notes 11 are transferred to or from a Teller money module 5. in most cases accounting 
transactions affecting the records of the banking system 20 are created^ Conversely transfers , be rtween 
Transaction money modules 4 do not involve any formal accounting procedures - - they involve only the 
transfer of electronic notes 11. 
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In the system being described, it is anticipated that the following arrangements ot accounts are to be 
utilized for each type of bank, categorized under each monetary unit: 
At an Issuing Bank 1 - 

(1) Money Issued Account: A liability account which reflects the money .ssued but not cleared. 
2 Money Due Account: An asset account reflecting the money deposited to the bank s accounts. 
(3) Deposited at Clearing Bank Account: An asset account reflecting the balance of a clearing account at 

^rCo^espoTdent Bank Money Account: A liability account owned by a Correspondent Bank 2 which is 
drawn upon by the Correspondent Bank 2 to dispense electronic money. 

(5) Money In Transit Account: A zero -balance liability account owned by each bank, wh.ch is used to 
temporarily maintain electronic money during a financial transaction. 

(6) Foreign Exchange Account: A zero -balance liability account owned by each bank, wh.ch is used to 
handle multiple currency exchanges. 

At a Correspondent Bank 2 - 

(1) Deposited at Issuing Bank Account: An asset account reflecting the balance of the Correspondent 
Bank 2 account at the Issuing Bank 1. 

(2) Money Due Account: An asset account reflecting the money deposited to the bank s accounts. 

(3) Foreign Exchange Account: A zero -balance liability account owned by each bank, which is used to 
handle multiple currency exchanges. 

(4) Money In Transit Account: A zero -balance liability account owned by each bank, wh.ch is used to 
temporarily maintain electronic money during a financial transaction. 

At the Clearing Bank 3: , 
(1) Issuing Bank Clearing Account: A liability account to net the amount of money cleared for an Issuing 

Bank 1. . 
The accounts, with their corresponding symbols, are summarized below: 
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Type of Bank 


Account Name 


Type 


Owner 


Symbol 


30 


Issuing 


Money Issue 
Money Due 

Deposited at Clearing Bank 
Correspondent Bank Money 
Money In Transit 
Foreign Exchange 


Liability 

Asset 

Asset 

Liability 

Liability 

Liability 


Issuing 
Issuing 
Issuing 

Correspondent 

Issuing 

Issuing 


Ml 

MD 

DC 

CM 

IT 

FX 


35 


Correspondent 


Deposited at Issuing Bank 
Money Due 
Money In Transit 
Foreign Exchange 


Asset 
Asset 
Liability 
Liability 


Correspondent 
Correspondent 
Correspondent 
Correspondent 


Dl 
MD 
IT 
FX 


40 


Clearing 


Clearing Account 


Liability 


Issuing 


CA 



Transaction processing, for a transaction such as a request for a withdrawal from savings, selects 
accounting processes so that the appropriate accounts may be credited and debited according , y It .s 
anticipated that the accounting processes will be using software programs and methods that are well known 
in the art and presently available; inasmuch as any of the programs and methods currently practiced and 
known for providing the foregoing accounting procedures would be suitable for use in the .nvent.on. To 
better understand the accounting processes of the invention, several examples of typical transactions and 
their associated accounting steps will be described. 

Accordingly. Figures 11-24 illustrate the accounting transactions for deposits, withdrawals, foreign 
exchanges, receipt of cleared money, electronic money/cash exchanges, and note 11 updates. F.gures 11 - 
14 and 19-22 also illustrate the accounting flows when a Transaction money module 4 contains notes n 
that are not involved in the particular transaction that is occurring. The notes 11 that are not part of the 
transaction are replaced with updated notes as discussed in the security procedures described above. For 
example when a subscriber deposits less electronic money than is stored in his/her Transaction Money 
Module 4. leaving a balance, the electronic notes 11 representing the balance are then replaced with 
electronic notes 11 containing the most up-to-date certificates. This latter case is indicated in the 
parenthetical on Figures 20 - 23 and 28 - 31 . 
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In an example of the accounting arrangements according to the invention (illustrated by Figure 11). If a 
subscriber were to deposit $50.00 out of $100.00 of electronic money contained in h.s/her Transaction 
money ^ules 4 at a Correspondent Bank's Teller money module 5 (Step 1). the entire $100 of electrons 
money would be extracted of which $50.00 would first be credited to his/her customer account (herein 
s denoted by "A"), the remaining $50.00 would be credited to the Correspondent Bank's In - Transit account, 
and $100 would be debited to the Money Due account at the Correspondent Bank 2. See "IT" and MD in 

F,9U After the $100 of electronic notes 11 is removed, the notes 11 are deposited from the Correspondent 
Teller money module 5 to the Teller money module 5 of an Issuing Bank 1 (Step 2). In acco mpl-shmg i his 
,o transfer, the Money Due account at the Correspondent Bank 2 is credited $100 while its Deposited a 
Issuing Bank account is debited by $100; the Issuing Bank 1 credits its Correspondent Bank Money account 
by $100 and debits its Money Due account by $100. 

In Step 3, the updated notes 11 are requested. Thus, the Correspondent Bank 2 requests from the 
Issuing Bank 1 the withdrawal of $50 of electronic money containing the most recent certificates from its 
, s Money Generator module 6. To support this request, $50 is credited to the Deposited at Issuing Bank 
account and $50 is debited from its Money In Transit account. The Issuing Bank 1 then debits $50 from its 
Correspondent Bank Money account and credits $50 to its Money Issued account. 

To complete the transaction, the $50 is then transferred from the Money Generator module 6 to the 
Correspondent Bank's 2 Teller money module 5 through the Issuing Bank's 1 Teller money module 5, and 
20 finally to the Transaction money module 4 (Steps 4-6). The net result of all of these transactions ,s that 
$50 remains deposited in the subscriber's account and $50 of newly issued electronic notes 11 are now 
stored in the Transaction money module 4 of the subscriber. 

Alternatively, if a subscriber begins with $50 in his/her Transaction money module 4 and deposits aM of 
it, the customer account would be credited $50 and the Money Due account would be deb.ted by $50 (Step 
25 1 of Figure 1 1 ; parenthetical entries). 

When there are only $50 of electronic notes 11 that are removed, the Correspondent Bank 2 credits the 
Money Due account $50 and the Deposited at Issuing Bank account is debited $50 (Step 2 parenthetica 
entries). This money is then deposited at the Issuing Bank 1 for later clearing, wherein the Correspondent 
Bank Money account is credited by $50 and the Money Due account is debited by $50. Because no 
updated electronic notes 11 need be returned in this situation, the deposit and its correspond.ng accounting 

is completed at Step 2. . . , , _ 

The accounting processes of an electronic money deposit at an Issuing Bank 1 instead of a 
Correspondent Bank involve fewer operational steps, which are illustrated in Figure 12. Us.ng the same 
dollar amounts as in the previous exemplary transaction, when $50 of $100 in electronic money stored .n 
the Transaction money module 4 are deposited directly to an Issuing Teller money module (Step 1), $50 
would be credited to the customers account (A). Fifty dollars would simultaneously be credited to the 
Money In Transit account, and $100 would be debited to the Money Due account at the Issuing Bank 1 

Since the entire $100 stored in the Transaction money module 4 is removed and transferred to the 
issuing Bank's Teller money module 5, it is necessary to return $50 of updated notes to the Transaction 
money module 4. Accordingly, as shown in Step 2 the Teller money module 5 requests $50 from its Money 
Generator module 6, debiting its Money In Transit account by $50 and crediting its Money Issued account 

by $50. . t" 1 1 

In response, $50 is created by the Money Generator module 6 and transferred to the Teller money 
module 5, which in turn transfers this electronic money to the Transaction money module 4 (Step 3 4). ^ 

When only $50 is stored in the Transaction money module 4 and all of it is deposited, the customers 
account (A) is credited $50, the Money Due account is credited $50, and that is the end of it. See 
parenthetical entries in Step 2 in Figure 12. . . timhu 

In the case of a withdrawal from a Correspondent Bank (see Figure 1 3), a withdrawal request of $1 00 by 
a subscriber using a Transaction money module 4 at a Correspondent Bank 2 will cause the subscribers 
account (A) to be debited by $100 and the Correspondent Bank's 2 Money In Transit account to be credited 
by $100 (Step 1). The request for the $100 withdrawal is forwarded to the Issuing Bank 1 from the 
Correspondent Bank 2. and the Correspondent Bank's Deposited at Issuing Bank account is cred.ted by 
$100 while its Money In Transit account is debited by $100 (Step 3). »>, „ Q „ 

Next, the request for $100 is forwarded by the Issuing Bank's 1 Teller money module 5 to the Money 
55 Generator module 6. Accordingly, the Correspondent Bank Money account gets a $100 debit while the 
Money Issued account gets a $100 credit (Step 4). 

The Money Generator module 6 then creates the $100 of electronic notes 11, and transfers .t to the 
Transaction money module 4 via the Issuing Bank's 1 Teller money module 5 and the Correspondent 
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entrieS) ' « 11 have been removed, the withdrawal request in Step 3 must be for $150. This 

r eq rrse $ sth°e f S^TJX « account to be credited by S1S0 and the Money ,n Trans, 

account to be debited by $150 (Step 3 P^^^^L Generator Module 6 and the Correspondent 
At the .ssuing Bank, $1 50 is re P ues *d^ account gets a S150 credit (Step 4 
Bank Money account gets a $150 debit : wniw y Generator Module 6 ($150) gets 

Issuing account by $100 (Step 1 2). locninn Bank's 1 Teller money module 5 to the 

A request for an updated $100 is then made by the ssu ng Bank s n £ V 
Money Generator module 6, which upon its creator, w, I r Mum ™?^j£*£m module 5 simply 
module 5 (Step 3). In completing the transa ebon the '^'"0 ™™ mod l 4 (Step 4). 

transfers this $100 containing the most recent ^^^^^^^J. 0 f the $100 withdrawal. 
..^^^^^^^P , Transit account wil, be credited 

$50 and the Money Due account will be debrtec I $50 (Step U r ^ ^ 

The issuing ^^^^^^J^L^ by $150 when the new notes 11 
rc^dTndThVX^ ^bited $50 (Step 2). Prom ther.^ is returned to the 

Tlsactn money module 4 via the Issuing Bank's ^^^J"^? £ this examp.e, a 

Figu re ^'^i^Too* e.eSc ^S^^S^^ -ney 
subscriber w.shes to exchange $100 of J „ mo modu | e 5 wi ,| cause the Issu.ng 

£60 of British currency. The deposit at ^ Banks TeUe y ^ ^ 

ess js, ^-ttzsx - sir ^ : 

£60 (Step 2). tt . ancanti on at the Issuina Bank 1 debits the Correspondent Bank Money 
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a balance of £60 while the Correspondent Bank's 2 Teller money module 5 finishes with a balance of $100 

(St8 The accounting transactions for a withdrawal or deposit of credit notes 11 also involve several 
accounting operations, as shown in Figure 17. When a subscriber wishes to withdraw money from his/her 
s credit line (Step 1), the proper credit note 11 is simply transferred from the Money Generator module 6 to 
the Transaction money module 4, reducing the customer's credit line by an equal amount to the amount 
transferred (Steps 2-4). 

Alternatively, when credit notes 11 are deposited by a subscriber's Transact.on money module 4, the 
subscriber's account is increased by the amount deposited, and the Money Due account is deb.ted by an 
w equal amount (Step 1 ). 

The accounting operations involving the Issuing Bank's 1 receipt of cleared electrons money will now 
be described. Referring to Figure 18, in this example $100 of electronic money and $100 of credit notes 11 
have been cleared by the Clearing Bank 3 to settle the balances among several Issuing Banks 1. The $100 
of electronic money and the $100 of credit notes are transferred to the proper Issuing Bank 1 (Step 1). 
Additionally, $50 of electronic notes 11 that it has issued are also deposited at the Issuing Bank 1. 
Consequently, the Issuing Bank 1 will debit the subscriber's account A by $100, debit the Issuing Bank's 
Money Issued account by $150, credit the Money Due Account by $50 and credit the Issuing Bank's 
Deposited at Clearing Bank account by $200 to complete the transaction. 

Turning now to Fig. 19. an accounting example of an exchange of cash for electronic notes 11 at an 
Issuing Bank 1 is shown. In this example, the subscriber wishes to exchange $50 of cash for $50 of 
electronic notes 11 to add to the $100 of electronic notes 11 already stored in his/her Transaction money 

module 4. . 

In the first transaction, the $50 of cash is deposited at the Issuing Bank 1 which causes the Money In 
Transit account to be credited by S50, while the cash account is debited by $50 (Step 1). 

Next the $100 of electronic notes 11 in the Transaction money module 4 is removed, resulting in the 
Money In Transit account being credited by $100, while the Money Due account is debited by $100 (Step 

2> " The Teller money module 5 will now request $150 of electronic notes 11 from the Money Generator 
module 6 to return $150 of electronic notes 11 to the subscriber (Step 3). Accordingly, the Money In Trans.t 
30 account is debited by $150 while the Money Issued account is credited by $150. 

The newly generated $150 of electronic notes 11 is then transferred from the Money Generator module 
6 to the Teller money module 5, who in turn transfers the $150 to the subscriber's Transact.on money 
module 4 (Step 4-5). The completed transaction leaves the subscriber with $150 of electrontc notes 11 and 
the Issuing Bank's Cash account containing a $50 balance. 

Also shown parenthetically in Fig. 19 is the case when the subscriber exchanges $50 of cash for 
electronic notes 11 when there is a zero balance in his/her Transaction money module 4. In Step 1, the $50 
of cash is deposited at the Issuing Bank 1 which causes the Money In Transit account to be credited by 
$50, while the cash account is debited by $50. Since no notes 11 are removed, no accounting is performed 
in Step 2. 

In Step 3, only $50 is requested from the Money Generator module 6, and the Money In Transit 
account is debited by $50 while the Money Issued account is credited by $50. The same transfer between 
money modules occurs as in Steps 4-5 of Fig. 19 described above, using only the $50 that was requested. 
This would leave the subscriber with $50 of electronic notes 11 in lieu of his original $50 of paper money. 

In Fig. 20, an exchange of cash for electronic notes 11 at a Correspondent Bank 2 is shown. This 
example uses'the same parameters as in Figure 19, namely, the subscriber has $50 of cash and $100 of 
electronic notes 11 in his Transaction money module 4. 

When the $50 in cash is deposited to the Correspondent Bank 2, its Money in Transit account is 
credited $50 while its Cash account is debited $50 (Step 1). The $100 of electronic notes 11 is then 
transferred from the Transaction money module 4 to the Correspondent Bank 2 which credits its Money In 
so Transit account by $100 and debits its Money Due account by $100 (Step 2). 

From there, the $100 of electronic notes 11 is deposited at the Issuing Bank 1, wherein its Money Due 
account is debited by $100 while its Correspondent Bank Money account is credited by $100 (Step 3). At 
the Correspondent Bank 2, the Deposited at Issuing Bank account is debited by $100 while the Money Due 
account is credited by $100. 
55 A withdrawal request is then made by the Correspondent Bank 2 for $150 from the Issuing Bank 1 (Step 
4). This request results in the Correspondent Bank 2 debiting its Money In Transit account by $150 and 
crediting its Deposited at Issuing Bank account by $150. 
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•~ug^<=«™«^.^" 2 ^ r J^^l2T^1, in Hrt. Transection -oney 
hTT""^ s'hTnTn Bo 20 « nteTs, ^ .net* in casn is ..posited ,0 the Correspondent 

After the Transactor mo y ffom the Transact i 0 n money module 4 - 

^l^cl^^^S^-ccour* to be credited by S100 and the Money Due account (at 
the issuing Bank 1) to be debited by $100^ ^ ^ from the Money 

onl» S» * Sored in his/L T Laction Money Module 4. At the Issuino Bank. $50 of electromo notes 11.S 

e ' eC r P ,r g S faction, in both case, the — <^ ^ 

STaTE? ^JTTn^^ --nic notes « in his.er Transaction 

m0n TL m e 0 xch l anqe of electronic notes 11 for paper cash at a Correspondent Bank 2 is illustrated in Figure 
22 ILTn^XilE^ in Figure ^"although the subscriber is only exchanging $50 of electromc 
notet 11 IIS $ToTof electronic notes 11 are transferred from the subscriber's Transacts money module 4 

(Ste Af!i'r th» notes 11 are transferred, the Correspondent Bank's 2 Teller money module 5 credits its 

Mo^TrJ^^rTbriS?^ <**» its ^ Due 3CCOUnt bV $10 °- Th,S $10 ° °L e,eCtr0 n ,C 
^llVnTLSS a/an Issuing Bank 1, causing the Correspondent ^ank s M o cred-t ,ts Money Due 

account by $100 while debiting its Deposited at Issuing Bank account by $10C (Step 2). 

At the Issuing Bank 1. $100 is credited to the Correspondent Bank Money account wh.le $100 is 
debited to the Money Due account. The Correspondent Bank 2 now makes a request to wrthdraw $50 of 
JSo^n^TSom the .ssuing Bank 1 (Step 3). Consequently, the Deposited at Issuing Bank account 
Ts credited by $50 while the Money In Transit account at the Correspondent Bank 2 is debited by $50. 

C the issuing Bank's 1 Teller money modu.e 5 request $50 from the Money Ge nerator module 6 and 
H-hitT*. rotrasDondent Bank Money account by $50 while crediting its Money Issued account by $50 

^T-^STSS-^^ "<*es 11 is tranSferred fr ° m the M ° ney 6enerat0r ,T d , U, ^ c rto U t 9 he 
Suing Bank 1 Teller money module 5 and the Correspondent Bank 2 Teller money module 5, back to the 

^XTusTated" ^.^SSpVih only $50 stored in the Transaction money module 4. wNch is 
, *J^TX2J£Z««L Bank 2 P . to be exchanged for paper money For this de positthe Money In 
Transit account is credited $50, and the Money Due account is deb,ted $50 (Step 1). The $50 .s then 
ipos tedTv^ "Se Correspondent Bank 2 to its account at the Issuing Bank 1. At the Correspondent Bank * 
fhe Money Due account receives a $50 credit, while the Deposited at Issuing Bank account rece.ves a $50 
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debit. On the Issuing Bank 1 side, it credits the Correspondent Bank Money account by $50 and debits the 

Hnnev Due account by $50 after receiving the $50 deposit (Step 2). 

H °T both lustrations, fifty dollars of paper cash is then transferred from the 

subscriber while the Correspondent Bank 2 debits its Money In Trans.t account by $50 and c edits .to cash 
5 account by $50 (Step 8). The subscriber is now left with $50 of paper cash and, ,n the first illustration, $50 
of electronic notes 11 stored in his/her Transaction money module 4. Hiffprpnt , ssuina Ranks 

Figure 23. the accounting process for clearing the electron.es money issued ^ different '~"'J9^ 
is shown This illustration uses an example in which $100 of electronic notes 11 issued by Bank B "as been 
deposed attesuing Bank A, and $150 of electronic notes 11 issued by Bank A have been deposited at 

W ,SSU in 9 Ste a p nk 1 issuing Bank A transfers the $100 issued by Bank B to the C.earing Bank 3. It then credits its 
Money Due accounted $100 and debits its Deposited at Clearing Bank account by the same amount ,n 
Step 2. issuing Bank B deposits the $150 of Issuing Bank A's money at the Clearing Bank 3 . .ts Money Due 
account is credited by $150, while its Deposited at Clearing Bank account is debited $150. 

,s °n sum? So is due to Bank B. Accordingly, $50 gets debited to the Clearing account of Bank A, wh.le 
$50 aets credited to the Clearing account of Bank B (Step 3). 

In Rgure 24, the accounting transactions corresponding to updating electronic notes 11 is shown. 
$100 of electronic notes 11 are stored in a Transaction money module 4 and are transferred to an Issuing 
lank 1. wherT$100 is credited to the Money In Transit account and $100 is debited to the Money Due 

20 "on! hundred dollars of electronic notes 11 are requested from the Money <*^™^£%* 
the Money In Transit account to be debited by $100 while the Money .ssued account is credited I by $100 
Sep 2). With this accomplished, the $100 of e.ectronic notes 11 is transferred from the Money ^Generato^ 
module 6 to the Issuing Bank's 1 Teller money module 5. which m turn transfers the money to the 

25 subscriber's Transaction money module 4 (Steps 3-4). 

Reconciliation and Clearing Systems 

Referring to Figure 25. the Transaction Reconciliation System 22 is shown. It will be i understood that the 
Tier money modules 5, the Money Generator modules 6 and the banking system 20 ^ penod.c^.y 
pass transaction records to a Transaction Reconciliation System 22 maintained at each partic.pat.ng bar£ 
vS^^Sion, will be analyzed and matched to determine if there is any faulty process oocumng m the 

System 22. which may be embodied in any -PJ^*^ 
suitably programmed general purpose computer but is not so limited, will ensure that all Teller money 
module TSnsactions with a financial impact, e.g.. deposits, and withdrawals and payments, match the 
appropriate accounting transactions. Any mismatches could indicate incomplete transact.ons or possible 

^"TSaSrreflecting the money issued by the Money Generator modules 6 **°^™^° nd * 
40 Teller money module 5 transactions and have the appropriate accounting transactions recorded. Any 
mismatched data may indicate incomplete processing or a security breach. Unmatched accounting 
tactions may be caused by incomplete transactions or an attempt to tamper with the records of the 

^tfheTererSd embodiment, these unmatched transactions may then be transferred to an investigation 
system 12 where the causes of the problems may be determined. On-line dialogues may be prov.ded o 

sysiem wucic uicv.au ^ , rt ^ K/ Jc q «h tn rifitftrm ne aDDroDriate 
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ST* ^ to^^'^=s^t "transaction records and to determine appropriate 
Sons to correct the situation. Investigators may then take corrective actions by adjusting accounts 
deactivating faulty TeHer money modules 5 and Money Generator modules 6. and notifying subscribers of 

Attention is now directed to Figure 26, which illustrates the clearing process for handling deposit 
transactions Correspondent Banks are not involved in this process because subscriber deposits are 
depoSed to their accounts at Issuing Banks 1 on a real -time basis. At ^^J^^Z 
aggregated by the Clearing System 13 to consolidate all deposited electronic money (includ.ng the deposits 
from Correspondent Banks) for transmission to the Clearing Bank 3. 

The Clearing Bank 3 may be implemented in any computer processing facility capable of accom 
modating the .arge number of transactions and corresponding amounts of data wh.ch the system , w,n 
typically handle. A high volume mainframe computer, a suitably sized minicomputer system, a number of 
networked work stations having the necessary data processing capabilities or combination of the foregoing 
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m a, aiso be used. As - be appreciated by a person skilied in « «. .he parser design o< the Cteerlng 

procedures, electronic money maybe ^^ZjTtrlZL. are actually occurring. Aiternatively. an 
SSjSTl "di oH~s b ein 9 performed during the course of - day for later 
batch processing, interbank processing could occur s^l times a day^ fc g ^ 

statistical and housekeeping J^tions. esse(J creatin a single debit and credit 

At the Clearing Bank 3, the deposit c° ns ° ,iaat '° ^ Q{ course , the appropriate accounting 

by the monetary unit ^ ^^^^ bearing processes. Any'accounts which are 
oSSeTJf tT^sTZbank settled processes that are common* used in the 

industry ' thof ;e r\<=>*re>c\ is sent back to the Money Issued Reconciliation 

Syst^ STeS ol^bankTthat ^dV^er^ " and checked for tampering and 

dUP 'l C HHitl a l statistical and housekeeping functions are implemented in the Money Issued Reconciliation 
4 ^nttoTot Figure issuing Bank's 1 provide their own Money .ssued Reconciliat,on System 
f rfyScaJy embo°d"d in a genera, purpose computer but not so .imited. for matching the electron, money 

issued to the f^' c ^ c ^^ C ^^ and e.ectronic money deposited at Issuing 

25 Banktr^ 

Reconciliation system 23 The Honey Issued R^oncM.atio y y Additionally, the Money 

SJS Z^rf^^^TJltZZ b X^ ?. -a, ^ has ^ M 
^TZ'^^T^TrX^T^T^ investors may *e„ d—e 

fJthl r«i ^ icationAaencv 28 for appropriate distribution throughout the Network 25. 

^^S^SKS 'ssued master file is accessed by the Money Position system 24 which creates a 

tSZl f T^L 9 Bank 1 In order to assess the risk of interbank settlement problems. 

Ope rational Sequences 

Although some aspects of the preferred embodiment may be described in terms of detailed laM 
45 diaarams the transaction functions are best illustrated by use of process flowcharts. Thus, * teolrtate 
unde?s?and ng o the operation of the money modules, several examples of transactions are set forth in the 
understanding OT ne operai j)ed descnption of the system processes 

"^3°^ - * the ^ emb0dim6nt ° f ^ 

so Pr T^^o!^th1^Tcrto^ S Cr S ed he flowcharts (except where indicated otherwise), the application 
funcSns o? the ^jScTSney modu.e 4, whether they are imbedded in a hand -held unit or other 
S^p^ng^SS.?-- hereinafter designated with the suffix "A", and the Teller money modue 5 
^Zl^l^^U^ bank are hereinafter designated with the suffix »B". In the case where a 
ColspondU Bank 2 interacts with an .ssuing Bank 1, the Issuing or Correspondent Bank 1 and ,ts 
« associated Teller money module 5 applications are hereinafter designated with a C . 

"ansitions to steps in another figure are indicated by a pentagonal tag having a 
a«phanurneric symbol, and continue on the other figure with a circle having the same alphanumeric symbol 
therein. 
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Withdrawal From An Issuing Bank 

in Fiaures 28-35A a process flowchart of a transaction between a Transaction money module 4 and 

Lctronic money from his/her account, to be stored in his*er Transac ton m£u*4. 

The orocess flow to set up a withdrawal transaction begins at the top of Figure 28. me t rst now ^ 
a JSi^uptaLen a money module A and a bank's Teller money modu.e B 5, which ,. .described 
furtl rngure 29 This process begins with money modu.e A performing a sign-on process that is also 
described in further detail in another figure, specifically Figure 31. 

Subscriber Sign - On 

Referring to the top of Figure 31. the subscriber prompts his/her Transaction money module ,4 1 to 
perform a sign -on function (Step 10). The Session Manager 31 application receives the sign -on message 
Sep and c heck s to see if the Transaction money modu.e 4 has inhibited subscribers from signmg on 

(Ste Su 1 bicriber sign-on may be inhibited if a user makes several unsuccessful attempts to s^r , on to the 
Transaction money module 4. For example, the allowable attempts to sign -on may be Im.ted to three 
20 I ch that if a person makes more than three consecutive unsuccessful attempts to sign -on itot e 
Transaction money module 4, the Session Manager 31 will prohibit any further sign - on attempts^ 
TdditonS ™ "lock-out" feature may be maintained for any predetermined t,me period .m* as 
t^-four hours, for example. Such an arrangement will provide security from persons who come , o 
r^2Uinr of the Transaction money module 4 but who are not properly authorized to access .t. It should 
be note lilZe Z ^To^rangernent is anticipated in the preferred embodiment of the inven.on 
Z "°enZn should not be Hmited as such, since any of the methods known in the industry for providing 
Qprnritv from unauthorized persons would be suitable for use herem. 

^KeTS^on is not inhibited, as will typica.ly be the case, To Subscriber 33 prompts the 
subs^ber to ente'r his/his sign-on characteristics, such as his/her PIN and biometr ,c -^Jj^^ 
Inouts from the subscriber are forwarded through the Session Manager 31 to the To Subscnber 33 
IpX^(5» M-2«. which responds to the characteristics entered and entitles the sutacntarto 
opeate the Transaction money modu.e 4 if the subscriber's identification character istics are the co rect 
oSes when compared to those stored in the memory of the Transaction money module 4 (Steps 30 32). 

Ifte subTcrfber's identification characteristics do not match the identifiers stored in memory the To 
SubL iber 3^p.Ltion notifies the subscriber of the inva.id sign -on condition (Step 34). From there he 
To £bsc ber » application checks to see how many times the user has ■W^"^"^ 
36) and if the predetermined count has not been reached, the Sess.on Manage 31 is notified (Step 38) 

The Session Manager 31 works in conjunction with the Clock^Timer 43 appl.caHon to set and to monitor 
the time thJTas elapsed between unsuccessfu. sign -on attempts (Step 40). In 

uns ccessfu. attempts within the set time period wil, cause the <^^™^£^ 
sign -on attempts, effectively shutting down the Transacts money module 4. The Session Manager 
notes that the sign on is terminated in Step 42. !„hihi*oH the. 

Turning back to Step 14 of Figure 31, assuming that the Transaction money module A M mhibteo. he 
Session Manager 31 checks to see if the predetermined time 
4 5 Transaction money module 4 is still in the prohibited sign-on mode, the To 

message to the subscriber that further access to the Transact.on money module 4 ,s prohibited (Steps 18 
20) The Session Manager 31 notes that the sign - on attempt is terminated, again in step 42. 
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Setup Withdrawal 

Turning to Figure 29, when a proper sign-on is accomplished, the To Subscriber A 33 prompts the 
subscribeMor the type of transaction that is desired (Step 43). As mentioned previously. ,t ,s ant.cpa ed 
that a Subscriber may transact with any one of a multitude of accounts at several different participating 
banks and financial institutions. m .... A in : t : atf »«. a 

After selecting the particular bank and account (Step 44), the ™™*™% U £ ^ 

procedure for communicating with the bank that was selected, by engaging *e Network 25. 
program flow now passes to the procedures illustrated by flowcharts in Figure 33. In Figure 33, there is 
shown the data processing and flow for implementing a sign - on to the Network 25. 
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Network Sign - on 
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The illustrative Network 25 sign-on method about to ^ ^^^^^S^ffS^y^ 
m oney modules 4,5,6 of the present embod.ment. Thus, .n this example, A 

module. cc ,i 0 ^ted the monev module initiates communication with the 

After the bank that is to be accessed ,s selected * e m °™ y ™ The Network Server 26 begins by 
Network 25 under the control of its Session ^ager A ^ (tap ^50) ^ ^ ^ ^ ^ 

guesting the certificate of ^l^^Z^ the certificate to Session Manager A 31 (Step 

sr sss 2 - — — 26 <step 58) ' which - upon rece[p ' 

module 4 (Step 68 - 70). message is a Transaction money module 4, 

list and the bad money module list (Steps 80 - 82^ Fig. 33A). sig nature is not valid, a message 

Public Key A 44 tests the vahd.ty of the signature (St ep ^^TaiScBBon A 33 of a Transaction 
warning of a ne^rk securit y problerr g£ ^^.J^ A application of a Teller 
money module 4 (Steps 86-90), °' ^^ eQ 2' all money modules will check the validity of a 
S^re^d SL^K^ This helps' to ensure the integrity of the overall 

Sy Tthe case of a valid signature, ^j!^^ js^o"^ re^e^fie^o/the ^ertif^ate^aT^p^ed^Steps^fS 
certificatory key list. (Step 94). If the certify ms *T * ^ of Fj 33C) while Public Key A 

and 98), the Maintain Security A V™^*™ S^Mctoy (Stop 128). Session Manager A sends 
STcSS — r^^-^ - —V of the signature 

^Ssumfngthat the signature of the new certificate is not valid at this stage, Steps 66 - 76, Fig. 33, are 
repeated so as to terminate the communication Mink intone ^oj k ^ ^ ^ 

On the other hand, a valid s.gnature. Fig. 33C. w.H a»ow *^ ecu * recejves ^ new 

certificate and send it back to the ^^.^S^S^wS^ * to again validate the 
certificate. Step 140. Rg. 33D. and forwards it to its Mart «n Secu my pp wji( repeat 

certificate through use of the Public Key -P^"^ ^ ^se * er ' 27. For a valid signature, the 

module A proves to be .nval.d, Fig. 33D. Session wia g aftem tQ va|jdate ^ 

with the certificate back to the Security f^^^^Z^^ ™ 8 s to Step 66, Fig. 33. 
signature on the certificate (Step 153- * .^^^T^fWn *.N«»<rt » (5* 
Alternatively, an invalid S1 9nature w.ll cause the Secur V Server 2 malfunction (Step 158). 

156. Fig. 33D) and cause the N ^r Se ™ r * in the case of a Transaction money 

The Session Manager A that receives the message (Step 60) v^, ^ ss 

module 4. get the To Subscriber A 33 tc .inquire of lha ^ S ^ r J ^T^oney module 5 or a Money 
£22 rur,^ SIZ^ l^tS ~ «~ is . request • retry the Network 25 

sign -on procedure (Step 166 & 168). intn the Network 25, and conversely, 
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• , ■ » m P Transaction money module's certificate for the Network Server 
Maintain Security A will again retrieve the Transaction mo y 

forward this data to the Network Server 26 (StepW and „ it js outside 0 f an 

The Network Server 26 checks the tome f nd u d ^ rv t 2 6 ^ send the new time and date (Step 110) to 
acceptable predetermined parameter, the J^^^^^er A 43 cannot adjust the date 

ssr: isss - * the money modu,e for subscriber or 

from the Network Server 26, Step ^^^XT^Je date and time check Step 
send the new date and time to the ^^^^ to exchange acknowledgements and note the 
108 allows the Network Server 26 and Session Manager a 

~r- ^„ /cton 126-128). 



J5 



108 allOWS xne ito"""^ ~ — 

successful Network 25 sign - on (Step 126-1 do) 
Establishing A Session 
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i~ ci^n-r>n transaction selection and network 
As shown in Figure 29, after the steps of f™^^^ 34 
sign-on are completed, sessions are which, as wi,l be understood by 

r ^„r^^SS£ 23 to other sessions established between the various 

requested connection to a speafc dest, a o in the JJJ^ ^ ^ » win «»n^ «» 

subscriber is desirous of transacting , with his/her ^ ou ^ 8 1 £,. 198 . Conversely, when a subscriber* 
Transaction money module 4 to »• ."^JJ^^Ld to establish a session with any specific 
performing updating functions on the WMrt connectjon , baS ed on Network 25 traffic 
bank, and the Network server 26 may dec.de where to route tn w A cQnveys the 

„ a specific destination has * Network Server 26 initiates a commu- 

Se Ter M = r ng A fhe acknowledgement that ^—^J^ S^^SE^ 
35 198). the Maintain Security application A will send , ts certftcaj _ to 

through each application's respective Session . JJ^JJ^rW^, t0 verify that each money module is 

that it is valid (Step 208). Manaoer 6 will note the session is terminated (Step 210). 

If the certificate is (end invalid, the session M »l^ ™ B inl „ ms to sub scrtt»r ol the transact™ 
,„ the case of a Transaction money mod* ,^oJ**<** Modu|e 6 , te to 

SSS^STb « to nS'S Panto; SML Step «a . is tha, - — * 

rs^rrmirm~r:aX.r « » - •» - - - 

communications can be terminated^ compromised money modules, then Random 

Alternatively, when money module A is not on .the >m of cc , p ^ ^ ^ ^ 

Number Generator B 46 creates • ^ "^JS^n? money modu.e A's public key (Step 218). Th.s 
module B's certificate and a verification messag e, ^usmg mon V 

encoded message is sent to money ^f^^J^^ney module B (Step 222). and uses its Public 
Session Manager A 31 receives the message from mo y verj mQney modu)e B s 

Key 44 algorithms application to decode the message (Step 224, F,g. 34B), 
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certificate (Step 226). 
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Hlll . p'e rprtifirate is invalid, the operation branches to an "abort 

lf the test amines tha^ = e ^^^^^Z^* a session (Steps 500 - 524). This 
tranS f ° maTe Z« oZZ e to en P d he communication session and to functional shut off money 
module* A, ^ZZt^T^Lu^on ,in k ending. (Steps 500 - 524, Figure 32). 

Abort Transaction 

= »„ n t„ Koure 32 the functional shul-off of a money module through the abort transaction 
Branching to Figure . 3i!Jhe tunc undoIS(ood m „ ms , olk ,„ing process may be used v.hen 

process „,ll ™^™™J^;X™™*S> «. »»«*»» oco^r* « m - 

Z rr/modle - " -X- and -V to illustrate the generic epplicabi,,., o. the process 

-t, abort .ration * ^ 

^t^e"^^ and th.nLlng ,« th, session has been 

^mf^f-lr. th. money module that is initiating th. termination is a Transaction money module 4. 
tb. riSc'riber .pplica.ion ? 'JZZTSTZ SET 

"e'ne^d ^"rXe^i, be .ovided by ? 
^^^^.^^ZT^^f^'^ ,0 the termination notice sen, by also 

'^Ig^Wre 3<B assuming .a, the --'-J I^ST fTS 

'^irrn^orTlf b"- noT^on »» «. * compromised money modules, and the 
More typically, money module o ;»i information to the Maintain 

. C ^^JL^"™rjZ£Z™£Z S i — < * * date and .me <Ste P 
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234 ^mmPtric Kev A 45 then encrypts the verification message with the date and time information using 

944 Flo 34C) An incorrect message will cause the session to be aborted through Steps 
S^i!S.^ B '^2^»U advance the procedure so that Maintain Security B 37 can compare 

^ S^STb « ISIS A nZZ ^CocK is within a preset amount of deviation from 
the clock Jmoney module e'tStep 250). If the discrepancy between the two Cocks .s greater than a 
redetermined amount, the session will be aborted by branching to Steps 500 - 524. 

If Ze S ^ no discrepancy that is greater than the permissible amount, Session Manager B 31 w.ll note 
its s ? a r o a session (Sep 252), and send an acknowledgement to money module A to start the transaction 
Step 254) A«e the encoded message is sent from money module B to Session Manager A 31 us.ng 
as process steps 2-8, Fig. 37, Session Manager A 31 acknowledges the message rece.pt and also notes the 
start of session (Steps 256-258). 
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Request Withdrawal 



10 



15 



25 



30 



35 



A fter a session is estate* between ^ T— rn oney ^^ZSZSXZ 
the Transaction money module 4 ™^ » ££^JS « be described, .t shou.d be 

29. Referring now to Figure 30, a process for 8 «J ^ra _ 

noted that a.though the figure ""^^"J^J^J^ 

they are applicable to any money module tnmsachng wth a g requesting a 

To begin, the To Teller X 34 sends a withdrawal request to , me missjon of the withdrawal 

certain amount of money to be withdrawn from a ^^^^^^ng money module 
reqU est. the account number and the account prof, e ^ 2 . 8 9 are repeate d, in 

Validate Account Number 

Once the withdrawal request and the account ^.^^^^^^ ^w d^ram 
module 5, a procedure to validate the account number is .n.tiated (Steps 

depicting how an account number is *^J**^ n j!^^ money mod ule 5 receives the account 
,n this process, the Maintain Security eppterton 37 of tte TO*. V ^ (Steps 

profile and signature and conveys them to its ™*^%™™Ld and distributed by the Bank's Security 
7041 -7042). The signature is tested using ^^^Z^™ to inform Is Session Manager 

^l^Z^^^^^ " * 32 ' are fo,,owed t0 abort the 

es r^^^^^^ 5 ^ " the account profi,e needs ,0 

^^zzxJtt the Te,,er money modu,e 5 

!Uls it to the money module making ^ e us)y 

The communication from the Teller money module £^ „ ^ *» 

described routine for sending messages Steps 2-8. TJjJ^r '^^jXlaintaln Security application 
account profile in the money ™ d "^ message is received 

37 in the Teller money module 5<S ^7^\^ r ^J^ uie 5 , and acknowledged in Step 7056. 
by the Maintain Security apphcat.on 37 of the Teller money moou , Jo Bapk 

With the account information checked, the ^"ffV^*^^^ request (Step 704). 
application 47 now verifies that there are efficient funds to PP^JJ^™ module V uti , i2i ng 

7 ;°4 "'the case of a Tel.er money module 5, ™ ^^™ZV»7Xn6s will cause the subscriber 
In the case of a Transaction money module 4 an ^ j^ 0 *^? 710 ^720 Fiqure 30A). As shown by Step 
t0 be prompted to enter a new amount for slnd the" newrequest to the To Bank 

724, the newly entered amount causes the To Teller *PPJ«J 0 "JJ pere are suffici ent funds to 

application 47 (using Steps 2-8) , of the , Te. er ^^^^^^ is sti.l greater than 
cover the latest requested amount, returning to Step 704 en rig 500 -524 to abort the 

the funds on balance at the bank, * «• ™«*» is 

transaction between the to money modules. In the case of a lei.er no y 
allowed to overdraw the account. 
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Transfer Notes 
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m „„. y module 5 (Step 45) « ^^^\ >I ^^Z»H , message to the T.lter money 

time the withdrawal request is made, the To Teller a appnc«wu 
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Become ~» s , " » %"J*' e D d ir S 0 TaPP«c*n 39 ot to .rans.o, o, mono, mod* choosos to 

fo^'S'noS' « <£p 763). Any'o-pi.od notto 11 <S..p 764, „i„ oauoo to onions » bo 

using to r^.^J^S" o^oTo 4 ; f*»f c~ wh.,0 , Tanar monoy m.du.o 5 is aoc.pting 

is upd.W w«h .ho now ^^J^" e "\fZ^sl to ...c.ronio now 11 novo boon transferred 

•rr- en.'irs iiSd ^ %s -U, mod* r 

applicatton B 47. Both in the case wnen .no row established between the Teller 

^not^^ — above in steps 19 °- 

258 As i9 notes iTa^repuested to satisfy the withdrawal, an account posting occurs to reflect »e request 
The To Bank application B 47 will post the proper account.no transactions (Step 778, Fig. 28) as also 

illustrated in Figure 14, Step 2. 

Request Notes 

Directing attention to Figure 40, notes 11 may be requested between Teller money modu.es 5 and 

sk^ Lvr.ssysi, . m ay M «., 784, „ „«. » 

e "°Ato r^on^olSonic now 11. .hoy ar. signed by .ho Pub* Key app.fca.on « o. to .Money 

™™* V'SSToompw. « witorawa, o, .Tronic no.es 11. to ^, ™«*e, «* 
d=^ 

detaneo aesenpuon ui v Transaction money module 4 that is 

transaction that has occurred above Step 690^ When J ^ subscrjber that the 

module it is transacting with. 
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module 4 committing .ts transact.cn w.th the ^I^^^^^^^^e B 5 and the Money Generator 

money from an Issuing Bank 1. 
Withdrawal From A Correspondent Bank 

th*n sTeos 7041 -7050 (see Figure 38) are performed to validate the account profile and number. 

* * Transaction money module 4, the To Transacts app .cation 49 of 

^JS^^SLwoement is encrypted and transmitted using the procedure . outlined in Steps 
2 - 8 wSrtby it is received by a To Teller application 34 of a depositing •J^^'*^ from 
Referring back to Figure 35, once the deposit request .s ^completed ^»J?" 11 " 3 ™^lL 
the Teller money module B 5 to the Teller money module C 5 using Steps 750 770, Figs 39. jha ae iaw 

~ : ;~vr --=r. vr. -r.-.-'H'HE 

S the f Transaction money module 4 to be replaced with updated electron* notes 11. 
between the two modules using the process Steps 190-258, Figs. 34, 34A o. 
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Q.ner.tor module 6 10 the Teller money module C 5 using Ih» Steps 750 - 770 F.gs. 38. 39/1 
""S, To Bank ~ S» « ^ ml^STe 
r^rrLT^-™" ^"'.1 trans^ed to — money module A 4 „so using 
SW ?o 7 2££*. withdraw.! from the Correspondent Bank 2. eaoh money module must commit to the 

rSm:i B %:"n y ey 1 mo*,^ C ZZXttL mcey m'odul. C s commits ,0 the Money Generator 

module 6, using the same process Steps 690 - 698. 

Deposit To An Issuing Bank 

Referring to Figure 42 in combination with Figure 43, an example of a deposit to an 
rJ^SZ^L I detai.. To start the transaction, a deposit set up must be done wh,ch uses the process 
steps shown in Figure 43 q r ^ ^ m monQy b k . After 

p^^^iron^ine'lbr a Transaction money module 4 (following Steps 10-42. F,gs. 31- 

deposit request, (S ' te P 40 ^ the deposit , To Subscriber A 33 prompts the subscriber for a 

rZuste^ IS ^^new amount is selected, the Session Manager A 31 informs the subscriber 
new amount ^^^^^7^ 414) , f the subscriber enters a new amount, Step 412. the 
^r^Tai'STSS^ Note Directory 39 appiication again checks for sufficient 

30 '"^Lsuminalherfare adequate funds within the money module, the process flow advances to the 
tJS^i^V^^oM in Steps 50-168. Figs. 33 - 33A. A successful Network 25 s.gn- 
^7en advances the'process flow to Steps 190 - 258, for establishing a session between the Transacts 

35 — y modules, the deposit request Jeps outHned in 

procedures 920 - 928 are followed conveying the request from Transaction money module A 4 to the ^Teller 
money module B 5. The To Teller A 34 transfers all of the electronic notes 11 stored w.thir , th .money 
Zule To the 6 Te ..er money module B 5 (Step 408) using the Steps 750 - 770 described above for 
transferrina electronic notes 11 between two money modules. 

<o CoZuTlto Figure 42. the To Bank B 47 posts the accounting transactions for the notes deposited 
(Step 4 8 ee Fig. 12 Step 1). In Teller money modu.e B 5. the To Transaction apphcat-on 49 checks to 
see if the amount deposited is less than the total notes 11 that were stored m module A and then 
Sns erred to Jhe Teller money module 5 (Step 420). If the deposit is less than the total amount of 
Sferred notes 11. updated notes 11 must be generated and sent back to the Transact.cn money module 

45 4 ' When all the notes that are contained in the Transaction money module 4 are deposited, i.e the 
amount to be deposited is not less than the total amount of electronic notes 11, the To Transact.cn B 49 w.M 
sTd an acknowledgement to the Transaction money module 4 (Step 428) using the Steps 2- B for ^sending 
messages between money modules. The To Teller A 34 receives the acknowledgement Step 430) and 
initiates the Steps 690-698 to commit the deposit transaction between the two money modules 

When the eLtronic notes 11 removed exceed the desired deposit amount, new ™£ 
be returned to the Transaction money module 4. To perform this, the To Bank appl.cat.on B 47 of the Teller 
mo ey modi E ,5 posts the prope'accounting transactions (Step 424; Fig 12. Step 2). Thereafter TeNer 
money module B 5 establishes a session with the Money Generator module 6 us.ng process ; Steps 90 

and^requests electronic notes 11 from the Money Generator modu.e 6 in the amount that should be 
returned to the Transaction money module 4, by performing Steps 780 792. *u a T «n«r 

The electronic notes 11 are created by the Money Generator module 6 and transferred to he Telle 
money module B 5 using Steps 750 - 770. With the electronic notes 11 m the possession of the Teller 
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monev module B 5 they are transferred to the Transaction money module A 4 using Steps 750-770 
m ^^ion money module A 4 receives the e.ectronic notes 1^ it ^^^S^* 
committing Teller money module B 5 to Transaction money module A 4 using Steps 690 696 ^ke^se, 
™ money module B 5 must commit to the Money Generator module 6 using the same Steps 690-698. 

Deposit To A Correspondent Bank 

Figure 45 illustrates the process flow for a deposit at a Correspondent Bank. In depositing to a 
Correspondent Bank 2, the deposit set up described in Steps 398 through 414 are repeated I .n the f. s 
Jtagerthe ^transaction From there the To Transaction B 49 tests to see if the deposit is less than the tota 
amounV of electronic notes 11 that have been withdrawn in the deposit set up procedures that were ,ust 

Pr0 Tn^c ( at P wh 4 ere al, the e.ectronic notes 11 stored in the Transaction money module 4 are , equal tc , the 
amount of notes 11 to be deposited, then To Transaction B 49 sends a depos.t acknowledgement back to 
tTe Ci^monS moduL 4 (Step 444), using Steps 2-8 to send the message from the Tel.er money 
module B 5 to Transaction money module A 4. . , nflmonf 

On the Transaction money module 4 side, the To Teller 34 application rece-ves th e 
fSteo 446) and uses Steps 690-698 to commit the transacts w.th Teller money module B 5. The 
SansaSon ley module 4 is now finished and removed from the process. The fina.izat.or .of the .deport 
Jirdes forThe account posting transactions to be made by the To Bank app.ication 47 (Step 448). See 
Fiaure 11 Step 1 for the accounting transactions. n R 

A sessions is now established between the Teller money module B 5 and Teller money module C 5 

USin Te^er P money module B 5 issues a request to make a deposit to the Te.ler money module C 5 by using 
process Ste^S 78<! 792. The To Bank B 47 then posts the accounting transactions (Step 450; see also F.g. 

11 ' Notes 2) 11 are now transferred from the Correspondent Bank B 2 to the f^^'lf^X 
750 - 770- the Issuing Bank C 1 posts the corresponding accounting transact.ons (Step 452, see also F.g. 
11 Step 2) Th, ™ Teller C 34 responds by sending the deposit acknowledgement (Step 454) us.ng Steps 
2 - 8 to To Teller application 34 of Teller money module B 5 (Fig. 45A, Step 456). 

Here again, the deposit is checked to see if it is less than the amount of electronic notes 11 that have 
been removed earlier, and when it is not, the withdrawal is completed with the process Steps 690 -698, F,g. 
41 to commit Teller money module B 5 to Teller money module C 5. 

A deposit request that is less than the amount of notes 11 that are withdrawn requ.res account updating 
(Step 46T S ee lso Fig. 1 1 , Step 3), and new notes 11 to replace the additional notes 11 that were taken 
Scordingly a withdrawal request following the process Steps of 920 - 928 from Te.ler money module B 5 
to Teller monev module C 5 is made to provide these new electronic notes 11. 

7!\ e?mZy module C 5 must first establish a session with the Money Generator module 6, us.ng the 
oroclss Steps T 9 0 - 258. The new electronic notes 11 are requested by the Teller money module C 5 from 
the MoneTGenerator module 6 fo.lowing process Steps 780 - 792, which are then transferred to the Teller 
monev module C 5 using Steps 750 - 770 to transfer notes 11 between money modules. 

^is transfer of e.ectronic notes 11 to the Tel.er money modu.e C 5 requires hat accounting 
transactions be posted by the To Bank application C 47 (Step 462, Fig. 45B; see also F.g. 11 Step 3) 

From there the notes 11 are transferred from the Issuing Bank's 1 Teller money module C 5 to the 
Correspondent Bank's 2 Teller money module B 5 and to the Transaction money module 4 by us.ng Steps 
750 - 77^ for transferring notes 11. Thereafter, each money module must commit to the money module wrth 
which^has eSablished a session. Thus, Transaction money modu.e A 4 commits to Te.ler money moduto 
^5 Te.ler money modu.e B 5 subsequent* commits to Te.ler money module C 5, wh.ch ^comm^ 
the Money Generator module 6. All three of these commitment transactions use process Steps 690 698 
so above. 

Subscriber To Subscriber Payment 

Figure 36 illustrates the process flow for a payment transaction from one Transaction money module 4 
55 to anSher. In this example of a preferred embodiment, Alice (or a hypothetica payor co^on .. 
denoted "A" in Figure 36) will agree to pay Bob (or a hypothetical payee corporation, is denoted B .n 
S 36) . specif amount of electronic money (Step 800). Both Alice and Bob sign on to the, respective 
Transaction money modules 4 using the process Steps 10-42 described above. Through the To Sub- 
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scriber A 33 application, Alice directs her Transaction money module 4 to make a payment (Step 806 & 
8I0). while Bob operates his Transaction money modute 4 such that the To Subscriber B 33 application will 
issue an entitlement to receive payment (Step 808 & 812). 

In Steps 814 & 816 the Session Managers 31 or both Alice's Transaction money module 4 and Bobs 
Transaction money module 4 established communications. From there a session is established, as 
described in Steps 190-258 above for transacting between any two money modules. 

With a session established, To Subscriber A 33 prompts the subscriber to enter the amount of payment 
that she desires to transfer (Step 818), which is displayed to the subscriber. 

Alice enters the amount that she wishes to transfer to Bob. Pay/Exchange application A 35 receives the 
amount entered (Fig. 36, Step 820). The amount entered by type (currency or credit) is now compared by 
Note Directory A 39 to the balance of the value of the electronic money stored in the Transaction money 
module 4, to see if there are sufficient funds available to permit the transaction to proceed (Step 822). 

If there are insufficient funds, To Subscriber A 33 sends the subscriber a notice that there are not 
sufficient funds to cover the transaction desired (Steps 824-826), and prompts the subscriber again for a 
new amount of payment (step 827). If the subscriber prefers not to enter a new amount, the abort 
transaction process Steps 500-524 are activated to terminate the communications link between the two 
Transaction money modules 4. On the other hand, a newly entered amount will return the process to Step 
820, to check for sufficient funds again. 

When there are sufficient funds stored in Transaction money module A 4 to process the transfer, 
Pay/Exchange A 35 sends a message disclosing the amount of the transfer to Bob's Transaction money 
module 4 (Step 828), using the process disclosed in Steps 2-8. See Fig. 36A. From there, To Subscriber B 
33 prompts the owner to verify that the amount to be transferred will be accepted by him (Step 830). Bob 
can then decide whether to accept or reject the amount to be transferred (Step 832). 

If Bob responds in the negative, then Pay/Exchange B 35 will send a message back to Transaction 
money module A 4 using Steps 2-8, that the amount to be transferred is incorrect (Step 834); the process 
again returns to Step 826, Fig. 36, to prompt Alice for a new amount to be entered. 

When Bob responds in the affirmative in Step 832, Pay/ Exchange B 35 will send an acknowledgement 
to Transaction money module A 4 using Steps 2 - 8 (Step 835). Back in Transaction money module A 4, the 
message will be conveyed to Pay/Exchange A 35 to receive the acknowledgment sent by Transaction 
30 money module B 4 (Step 836). 

With this acknowledgement received, Pay/Exchange A 35 will send the amount desired to be trans- 
ferred to the Honey Holder 38 (Step 838) so that the electronic notes 11 may be transferred using Steps 
750-770. With the transfer completed, the two Transaction money modules 4 must commit to the transfer 
using Step 690-698 described above. The communication link between the two transaction modules may 
35 now be terminated. 

Subscriber to Subscriber Foreign Exchange 

Referring to Figure 46, the process flow for an exchange of foreign currencies between two Transaction 
money modules 4 will now be illustrated. In this example Alice (or a hypothetical corporation, denoted "A" 
in Figures 46-46A) agrees to exchange dollars for pounds with Bob (or a hypothetical corporation, denoted 
"B" in Figures 46-46A). The exchange rate that they have agreed to will be a ratio of dollars to pounds 
(Step 300). 

Alice begins by signing on to her Transaction money module 4 (using Steps 10-42 described above) 
while Bob signs on to his Transaction money module 4 (using Steps 10-42). Thereafter, the To Subscriber 
33 applications of both Transaction money modules 4 prompt the respective users to select a type of 
transaction (Steps 302-303). In this example, Alice and Bob agree to exchange her dollars for his pounds. 

By requesting the foreign exchange transaction, Session Manager A 31 will establish a communications 
link with Session Manager B 31 (Steps 306, 307) so that a session may be established between the two 
so money modules using Steps 190-258. Alice is then prompted by To Subscriber A 33 for the amount of 
dollars she will sell, and the exchange rate that she will use in the transaction (Step 308). 

Pay/Exchange A 35 receives the input (Step 310) and Note Directory A 39 checks for sufficient funds 
by comparing the amount requested to the amount of value contained in the Transaction money module 4 
(Step 312). An insufficient funds condition will cause the To Subscriber A 33 to send an insufficient funds 
65 message to Alice and prompt the subscriber to select another amount of dollars and exchange rate (Steps 
318-320). When new selections are entered, the process flow returns to Step 312 and continues from 
there. If Alice does not select a new amount, the session is dissolved using abort transaction Steps 500- 
524. 
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Wh^n the funds are sufficient to meet the amount requested, the Pay/Exchange A 35 sends the amount 
of the dollars and the proposed dollar/pound exchange rate (Step 316) to the To Subscriber apphcat.on 33 
of Transaction money module B 4 using the Steps 2 - 8. (See Figure 46A). At this point, To Subscr.ber B 33 
prompts Bob with the amount and rate proposed by Alice, to determine ,f the values are what Bob will 

aqree to exchange (Step 322). 

The Pay/Exchange B 35 receives the dollar amount and the rate that .s proposed by Alice and . he 
amount and rate are not agreed to by Bob, Pay/Exchange B 35 will send a message indicating that the 
value or exchange rate is incorrect (Step 326), through the Steps of 2-8 for sending messages. To 
Subscriber A 33 prompts Alice for the dollar amount and exchange rate over again (Step 327). Entry of new 
values returns the process to Step 310 for continuation, see Fig. 46, while the lack of new values entered 
causes the abort transaction process of Steps 500-524 to be initiated. 

If the amount and rate are agreed to by Bob, Pay/Exchange B 35 will calculate the equivalent amount m 
pounds, based on the rate provided (not shown), and then initiate the step of having Note Directory B 39 
check to see that Transaction money module B 4 contains sufficient funds to fulfill the exchange (Step 
323) When the funds in Transaction money module B 4 are insufficient to meet the exchange, 
Pay/Exchange B 35 sends a message to Alice of insufficient funds (Step 325) using Steps 2-8. The 

process flow returns to Step 327. 

Proceeding with the case in which sufficient funds do exist in Transaction money module B 4, 
Pay/Exchange B 35 will send an acknowledgement using Steps 2-8 to Transaction money module A - 
(Step 329) After receiving this acknowledgement, Pay/Exchange A 35 sends the amount of dollars 
requested to its corresponding Money Holder 38 application in Step 330. The dollars are transferred from 
Alice to Bob via the Steps 750 - 770 described above for transferring notes 11. 

Pay/Exchange B 35 receives the notes 11 and then transfers the amount of pounds to its Money Holder 
38 application (Step 331). From there, the electronic pounds are transferred to Alice using the transfer notes 
process described in Steps 750 - 770. To record this exchange, Transaction money module A 4 commits 
with Transaction money module B 4 by using process Steps 690-698 described above. With a satisfactory 
exchange, the communications link between the two Transaction money modules may now be terminated. 

Foreign Exchange At An Issuing Bank 

Turning attention now to Figure 48, if a subscriber were to exchange his/her dollars for pounds with an 
Issuing Bank 1 instead of with a subscriber, the following process is followed. 

Subscriber A sets up the foreign exchange transaction by signing on to his/her Transaction money 
module 4 (see Fig. 47Z) using Steps 10-42 described above. To Subscriber A 33 prompts the subscriber 
for the transaction desired (Step 334), and in this example, the subscriber chooses the dollar/pound 
exchange, and the amount of dollars the subscriber will exchange. It is anticipated that the choice of the 
bank to transact with may be an option offered to the subscriber (Step 336). 

The Note Directory A 39 checks for a sufficient balance to complete the request (Step 338). An 
insufficient balance permits the subscriber to again enter the amount he/she will exchange (Step 340- 
342) whereby Session Manager A 31 will terminate the transaction (Step 345) if no new amount is entered. 
Entry of a new amount returns the process to Step 338 to check for sufficient funds to meet the new 
request. When the funds are sufficient for the exchange request, a Network 25 sign -on using Steps 50- 

168 is commenced. . . . 

After the Network 25 sign -on, the Network 25 checks if a bank or financial mstitution has been 
selected (Step 346). If a bank or financial institution was not chosen earlier, To Teller A 34 must prompt the 
Network Server 26, through Session Manager A 31, for a list of banks or financial institutions that will 
provide the exchange (Steps 348-350). The Network Server 26 sends the list (along with rates) to the 
subscriber through the To Teller A 34 and To Subscriber A 33 applications (Steps 352 - 356). 

After prompting (Step 357. Fig. 47A), the subscriber chooses a bank or financial institution or ends the 
transaction (Step 359). When a bank or financial institution is chosen, a session is established w.th the 
Teller money module 5 chosen using Steps 190-258 described above. After a session is established To 
Teller A 34 sends the amount of dollars to be exchanged for pounds (Step 360) using Steps 2-8 for 
encrypting and transmitting a message. 

To ensure that the subscriber still wants to proceed with the exchange, To Transaction B 49 sends the 
current exchange rate to the subscriber using process Steps 2-8 (Step 362). At this point, To Subscriber A 
33 prompts the subscriber with the bank's exchange rate and if the subscriber does not wish to proceed, 
the transaction is aborted by following Steps 500-524 (Steps 364 - 366). If the transaction is to proceed, 
the dollars are transferred from Transaction money module A 4 to Teller money module B 5 using Steps 
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SST^^ ™ S -ron, - Money O.nor»o, moo* 6 ,0 « 

T- ^^l"S^^^-«--, o, « 

. 9\ ThP notes 11 are transferred to the Transaction money module A 4 througn 

S D "cet°St?ps 5 ^ ^^^o^ ^Kctanfl-. Transaction money module A 4 commits to Teller 
money modufe B 5 who subsequently commits to the Money Generator module 6 us.ng process Steps 
690 - 698. 

Foreign Exchange At A Correspondent Bank 

Th* torsion exchanqe with a Correspondent Bank 2 is described with the aid of Figure 49. Initially, the 

SteP A 'withdrawal is requested by Teller money module B 5 to Teller money module C 5 using process 
Steps S-928 des^bed above To obtain the notes 11 for the request. Teller money module C 5 must 
2 tLm from a Money Generator module 6. Accordingly, a session is established between the two money 
moduleT v^ Steps 190 y -25^ ^ and the notes 11 are requested following process Steps 780-792 outlined 



above. 
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The Money Generator module 6 will create the notes 11 requested and transfer them to Teller money 
JI? b Tusina process Steps 750 - 770. This is followed by a posting to the proper accounts in the 
£££ S ysVmT(sSr374) see Figure 16. Step 3 for accounting transactions). The notes 11 are now 
SSirSt^TellJ? money module C to Transaction money module A 4 via Teller money modute B 5 
uTna or eac^ T transfer the process Steps 750 - 770. Finally, all the sessions must be committed, and 
SSJSL^I^ule A 4 commits to Teller money module B 5 who in turn commits to Tel.er money 
modufe C 5 using Steps 690 - 698. Teller money module C 5 commits to the Honey Generator module 6 to 
complete the exchange of dollars for pounds. 

Updating Notes, Certificate 

As mentioned above, it is anticipated that the date of expiration of a note, used as a security measure 
maytxdre white it is stored in a Transaction money module 4. If this occurs, the holder of expired notes 11 
S n7be able to transfer them to another Transaction money module 4. but the holder may deposit them 
or exchange them for new notes 11 by transacting with a participating bank or f.nancial ' nstltu * on . 

Additionally, if the certificate associated with a particular Transacts money module 4 exp,res the 
subscriber must sign on the Network 25 to update the certificate .n order to transact w,th another 
TlsactL money module 4. The following is a description of the process flow for updatmg an ex Pl red 

45 ^^^t^ZVl^e 50. a subscriber signs on to the Transaction money module 4 using the 
Steps 10-42 described above, and is prompted by To Subscriber A 33 to select a .transaction (Step 570* 
After seating the transaction for "updating" (Step 572). a sign -on to the Network ^tae ^ 
Steps 50-168 The sign -on to the Network 25 will perform the updating of the certificate, as described 

50 ^^^^.^~2!Ln Manager A 31 sends the update , no* request to the , Ne^ork 
25 (Step 574) the Network Server 26 responds by sending the selected bank identifier back to the 
T^nsaSon money modu.e 4 (Step 576). Now, a session may be established between ^ the Transacts 
money module A 4 and the Teller money module B 5 of the bank selected, us.ng Steps 1 ^-258. 

55 Once the session is established. To Teller A 34 sends the request to update notes 11 (Step 578) usmg 
the message sending routine in Steps 2 - 8. To Transactor B 32 responds, Fig. 50A, w.th an acknowledge- 
ment (Step 580) sent using Steps 2-8. Transaction money module A 4 can now transfer the expired I notes 
™ to Teller money module B 5 using Steps 750 - 770. Thereafter, the corresponding accounting (see 
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Figure ?4. Step 1) is performed in the bank's records (Step 582), and a session is established between 
Teller money module B 5 and the Money Generator module 6 through Steps 190 - 258. 

The request notes routine of Steps 780-792 is then performed. The Money Generator module 6 sends 
the requested notes 11 via Steps 750-770, and updates the accounts at the bank (Step 584; see also Fig. 

5 24, Step 2). Teller money module B 5 takes the updated notes 11 and passes them to Transacts money 
module A 4 using the same Steps 750-770. 

Now that the notes 11 have been updated in the Transaction money module 4, the sess.ons are 
completed by having Transaction money module A 4 commit to Teller money module B 5 and having 
Teller money module B 5 then commit the transaction with the Honey Generator module 6. Finally, both 

,o committing routines are performed using Steps 690-698 described above. 

The above described process flows illustrate the capability of the invention to provide an improved 
system for exchanging electronic representations of economic value, while avoiding the inherent limitations 
of paper based monetary systems. 

Operation of the invention has been described primarily with currency notes and credit notes that can 

,s be used by subscribers in the same processes. It will be understood that the described system can also be 
adapted to other monetary instruments. For example, personal and corporate checks and bank drafts could 
be provided by enhancing several of the Transactor applications. More complicated mult.party payment 
processes such as letters of credit and banker's acceptances could also be provided with appropriate 
changes to the system. It may also be possible to adapt the system of the invention to provide corporate 

20 financial obligations such as commercial paper. 

Moreover although the invention has been described in detail with particular reference to a preferred 
embodiment thereof, it should be understood that the invention is capable of other and different embodi- 
ments and its details are capable of modifications in various obvious respects. As is readily apparent to 
those skilled in the art, variations and modifications can be affected while remaining within the spirit and 

25 scope of the invention. Accordingly, the foregoing disclosure, description, and figures are for illustrative 
purposes only, and do not in any way limit the invention, which is defined only by the claims. 

Claims 

An electronic monetary system for providing transactions utilizing electronic representations of currency 
backed by demand deposits in a bank comprising: 

means for generating said electronic representations of currency; 
teller means for issuing and distributing said electronic representations of currency; 
transacting means for storing, and for transferring said electronic representations of currency 
between other transacting means and between said transacting means and said teller means. 

An electronic monetary system for providing transactions utilizing electronic representations of credit 
authorizations comprising: 

means for generating said electronic representations of credit; 
teller means for issuing and distributing said electronic representations of credit; 
transaction means for storing, and for transferring said electronic representations of credit between 
other transacting means and between said transacting means and said teller means. 

3. An electronic monetary system according to claim 1 or claim 2 further comprising a means for 
45 maintaining the security and integrity of said electronic monetary system. 

4. An electronic monetary system according to claim 1 or claim 2 further comprising a means for 
providing a communication network between said generating means, said teller means, said transacting 
means, and said security means. 
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An electronic monetary system according to claim 1 or claim 2 further comprising a means for 
maintaining and processing account data files for storing records of said electronic representations of 
currency or credit issued by said generating means and records of said electronic representations of 
currency or credit transferred by said transacting means to said teller means. 

An electronic monetary system according to claim 3 wherein said security means further comprises a 
time limit on the transferability of said electronic representations of credit and said electronic repre 
sentations of currency among said transacting means. 
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7 An electronic monetary system according to claim 3 wherein said generating means, said teller means 
and said transacting means each comprise an individual identifier, and said means for maintaining the 
security of said electronic monetary system further comprises a certification means for providing a 
unique certificate of said identifier of each of said generating means, said teller means and said 
5 transacting means. 

8. An electronic monetary system according to claim 7 wherein said certificate further comprises a time 
limit on its acceptability by said generating means, said teller means or other of said transacting 
means. 

9 An electronic monetary system according to claim 1 or claim 2 wherein said generating means further 
comprises a public key digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

15 10 An electronic monetary system according to claim 1 or claim 2 wherein said teller means further 
comprises a public key digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

11 An electronic monetary system according to claim 1 or claim 2 wherein said transacting means further 
so ' comprises a public key digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

12, An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit are undeniably acceptable as economic value. 
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13 An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit are commutable and transferable in values less 
than or equal to their original economic value when generated. 

14. An electronic monetary system according to claim 13 wherein said electronic representation of credit is 
transferable only one time by said transacting means. 



15. An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit further comprise indicia of 

35 (1) whether said representation is a currency or a credit representation, 

(2) its said time limit of transferability, and 

(3) its economic value. 

16. An electronic monetary system according to claim 15 wherein said indicia further comprise indicia of 
40 (1) said certificates of said other transacting means, 

(2) said certificates of said teller means, and 

(3) said certificate of said generating means. 

17. An electronic monetary system according to claim 16 wherein said indicia further comprise indicia of 
45 (1) a digital signature of said generating means, 

(2) a digital signature of said teller means, and 

(3) a digital signatures of said other transacting means. 

18. An electronic monetary system according to claim 1 or claim 2 wherein said generating means, said 
so teller means, and said transacting means are each comprised of a programmable processing device 

contained in a tamper -proof housing. 

19. An electronic monetary system according to claim 18 wherein said generating means, said teller 
means, and said transacting means are configured to perform as a modular co- processor of a general 

55 purpose computer. 

20. An electronic monetary system according to claim 18 wherein each of said programmable processing 
devices further comprises a list of other offending programmable processing devices. 

39 
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21 An electronic monetary system according to claim 1 or claim 2 further comprising a means for clearing 
said electronic representations of credit and currency issued by more than one bank. 

22. An electronic monetary system according to claim 1 or claim 2 wherein said financial facilities further 
comprise an accounting structure to monitor the distribution of said e.ectron.c representations of 
currency or said electronic representations of credit and each financial facility's obl.gat.on after any 

financial transaction. 

23. An electronic monetary system according to claim 18 wherein said programmable Processing device in 
said transacting means further comprises separate lists for accounts assoc.ated w,th the owner of sa.d 
transacting means that are held at each of said different financial facilities. 

24. An electronic monetary system according to claim 23 wherein each of said list of accounts further 
comprises a digital signature of the financial facility maintaining said accounts, to provide security from 

75 unauthorized access of said accounts. 

An electronic monetary system according to claim 1 or claim 2 wherein said generating means is 
configured to generate said electronic representations of currency or said electronic representations of 
credit for a plurality of monetary units. 

An electronic monetary system according to claim 18 wherein each of said programmable processing 
devices can be personally coded to prohibit use by unauthorized persons, such coding being 
performed by an individual that does not have any relationship with any of said financial fac.lit.es, and 
whose identity remains anonymous. 



20 



25. 



26. 



25 



27. A monetary system using electronic representations of money and including at least one f.nanc.al 
facility and subscribers served by said facility, said system comprising: 

a plurality of subscriber processors, each adapted to contain said electronic representations in the 
form of machine readable digital objects containing data indicative of the monetary value represented 
30 and the current validity of said representations; 

processing means operated by said financial facility and capable of commun.cat.ng with said 
subscriber processors for the deposit in said facility of representations stored in said subscriber 
processors, or the withdrawal or representations from said facility to said subscriber processors; 

said subscriber processors also including communication and processing functions enabling 
35 exchange of said representations between subscriber processors. 

28. A system according to claim 27 in which said money representations are configured to be functionally 
equivalent to bank notes. 

40 29. A system according to claim 27 including a certification source enabling the processing of said 
representations to indicate their validity. 

30 A system according to claim 27 in which there are a plurality of said financial facilities and a clearing 
facility for clearing transactions among said financial facilities and said subscriber processors. 

31. A system according to claim 27 in which said data stored in said subscriber processors includes data 
representations for ascertaining the status of said representations. 

32. A system according to claim 27 in which said electronic representations of money stored in said 
subscriber processors are replaced with updated representations during transactions with sa.d f.nancial 
facility. 

33. A monetary system using electronic media to securely and reliably exchange economic value, said 
monetary system comprising: 

electronic representations of credit authorizations and electronic representations of currency 

backed by demand deposits in a bank; 

means for generating said electronic representations of credit and said electronic representat.ons of 

currency; 
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teller means coupled to said generating means for issuing, distributing, and accepting said 
electronic representations of credit and currency; and 

transacting means for storing, and for transferring said electronic representations of cred.t and 
currency with other transacting means and between said transacting means and sa.d teller means. 

5 34 A monetary system according to claim 33 further comprising a means for transmitting said electronic 
repTesentaLs in a secure manner between said generating means, sa.d toller means and sa.d 
transmitting means to maintain the security and integrity of said monetary system. 

w 35 A monetary system according to claim 34 wherein said security means further comprises a time limit 
onTe transferability of said electronic representations of credit and currency among sa.d transact^ 



means. 



36 A monetary system according to claim 34 wherein said generating means, sa.d teller means and sa.d 
^act ng means each comprise an individual identifier, and said means for rn.nton.ng the secunty of 
said monetary system further comprises a certification means for prov.d.ng a un.que certificate of sa.d 
identifier of each of said generating means, said teller means and said transacting means. 

37 A monetary system according to claim 36 wherein said certificate further comprises a time limit on its 
' acceptability by said generating means, said teller means or other of said transactmg means. 

38 A monetary system according to claim 34 further comprising a networking means for providing a 
communication link between said generating means, said teller means, said transactmg means, and 

said security means. 

39 A monetary system according to claim 33 wherein said generating means is configured for generating 
' said electronic representations of credit and currency for a plurality of monetary un.ts. 

40. A monetary system according to claim 33 wherein said electronic repres «ntations of ^edit j and 
currency are undeniably acceptable as economic value, and are confutable and transferrable in 
values less than or equal to their original economic value. 

A monetary system according to claim 40 wherein said electronic representation of credit is transfer- 
able only one time by said transacting means. 

A monetary system according to claim 33 wherein said generating means further comprises a public 
key digital forming means for forming a digital signature on said electronic representations of credit and 
currency. 

43. A monetary system according to claim 33 wherein said teller means further comprises a public key 
digital forming means for forming a digital signature on said electronic representat.ons of cred.t and 

currency. 

44. A monetary system according to claim 33 wherein said transacting means further comprises a public 
key digital forming means for forming a digital signature on said electronic representat.ons of credrt and 
currency. 

45. A monetary system according to claim 41 wherein said electronic representations of credit and 

currency comprise indicia of 
so (1) whether said representation is a currency or a credit representation, 

(2) its said time limit of transferability, 

(3) its economic value, 

(4) said digital signature of said generating means, 

(5) said digital signatures of said teller means, 

55 (6) said digital signatures of other transacting means, 

(7) said certificates of other transacting means, 

(8) said certificates of said teller means, 

(9) said certificate of said generating means, and 
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(10) an identifier of said electronic representation of currency or credit. 

46 A monetary system according to claim 33 wherein said generating means, said teller means, and said 
transacting means are each comprised of a programmable processing device contained in a tamper 
5 proof housing. 

47. A monetary system according to claim 46 wherein said generating means, said teller means, and said 
transacting means are configured to perform as a modular co - processor of a computer. 

io 48. A monetary system according to claim 33 further comprising a means for clearing said electronic 
representations of credit and currency issued by more than one bank. 

49. A method of using electronic representations of currency or electronic representations of credit 
provided by at least one financial facility having a means for generating said electronic representations, 
and a teller means for issuing and accepting said electronic representations and serving subscribers of 
said facility, comprising the steps of: 

(1) generating said electronic representations of currency backed by demand deposits or generating 
said electronic representations of credit authorizations; 

(2) issuing to said subscribers and accepting from said subscribers electronic representations of 
currency or credit, wherein the issuance and acceptance is performed by said teller means at said 
financial facility; and 

(3) providing said subscribers with a transacting means for accepting said issued electronic 
representations of currency or credit, and for transferring said electronic representations of currency 
or credit to both other subscribers having said transacting means, and to said teller means. 



75 



25 



40 



50. The method of claim 49 further comprising the step of digitally signing said electronic representations 
of currency or credit to provide authenticity and security from duplication or modification. 

51. The method of claim 50 further comprising the step of limiting the time period that said electronic 
30 representations of currency or credit may be transferred among said transacting means. 

52. The method of claim 51 further comprising the step of removing all of said electronic representations of 
currency stored in said transacting means whenever said transacting means transacts with said 
financial facility, the step of generating new electronic representations of currency having a renewed 

35 time limit on transferability, and the step of replacing said original electronic representations of currency 
in said transacting means with said new electronic representations of currency. 

53. The method of claim 51 further comprising the step of removing all non - transferred electronic 
representations of credit authorizations stored in said transacting means only whenever said transacting 
means transacts with the financial facility issuing said electronic representations of credit, the step of 
generating new electronic representations of credit having a renewed time limit on transferability, and 
the step of replacing said original electronic representations of credit in said transacting means with 
said new electronic representations of credit. 

45 54. The method of claim 49 further comprising the steps of clearing, and maintaining records of said 
electronic representations of currency or credit issued by said financial facilities. 

55. The method of claim 49 further comprising the step of providing an identifier unique to each of said 
generating means, said teller means and said transacting means. 

The method of claim 55 further comprising the step of certifying for a limited period of time the validity 
of said identifier of each of said generating means, said teller means and said transacting means. 

57. The method of claim 56 further comprising the step of providing a list of any offending teller means, 
generating means, or transacting means to each of said generating means, said teller means and said 
transacting means. 
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58. The method of claim 49 further comprising the step of generating said electronic representations of 
credit and currency for a plurality of different monetary units. 

59 The method of claim 49 further comprising the step of providing an accounting structure at said 
" financial facilities to monitor the distribution of said electronic representations of currency or credit, and 
each financial facility's obligation after any financial transaction. 

60. The method of claim 59 further comprising the step of storing in said transacting means separate lists 
for accounts associated with said subscriber at each of said financial facilities. 

61 The method of claim 60 further comprising the step of digitally signing each of said list of bank 
" accounts with the digital signature of the corresponding financial facility, to provide security from 

unauthorized access of said accounts. 

62 The method of claim 55 further comprising the step of maintaining records of transactions undertaken 
" by said generating means, said teller means and said transacting means and storing said records within 

each of said respective generating means, said teller means and said transacting means, wherein said 
transaction record includes indicia of the date of transfer, the amount of transfer, an identifier o the 
financial facility issuing said electronic representations of currency or credit, and an identifier of the 
electronic representation of currency or credit transferred. 

63 The method of claim 62 further comprising the step of maintaining copies of said electronic repre- 
' sentations of currency and credit issued at said financial facilities, and the step of updating said copies 

upon transacting with any of said transacting means. 

64 The method of claim 63 further comprising the step of reconciling said copies of electronic repre- 
" sentations of currency and credit with electronic representations of currency and credit that have been 

cleared in said financial facilities. 

30 65. The method of claim 64 further comprising the steps of: 

(1) storing records of individual transactions that have occurred among said transacting means to a 
separate storage means, 

(2) submitting said records of individual transactions stored in said storage means to said financial 
facilities when said electronic representations of currency or credit are stored in a transacting means 

35 that becomes lost or stolen, and 

(3) comparing said records of individual transactions among said transacting means with records 
produced by said reconciliation of said electronic representations of currency and credit to deter- 
mine the true value of said electronic representations of currency and credit stored in said 
transacting means that may be lost or stolen, for accurate replacement of said value lost. 

66. The method of claim 49 further comprising the step of providing a communication network, linking 
together said financial facilities and said transacting means. 
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